kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net/bluetooth
History
Young Xiao acaf43aa7e Bluetooth: hidp: fix buffer overflow 
commit a1616a5ac9 upstream.

Struct ca is copied from userspace. It is not checked whether the "name"
field is NULL terminated, which allows local users to obtain potentially
sensitive information from kernel stack memory, via a HIDPCONNADD command.

This vulnerability is similar to CVE-2011-1079.

Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-06-20 18:11:27 +01:00
..
bnep Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket 2018-01-01 20:52:08 +00:00
cmtp Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket 2018-01-01 20:52:08 +00:00
hidp Bluetooth: hidp: fix buffer overflow 2019-06-20 18:11:27 +01:00
rfcomm Bluetooth: Fix potential NULL dereference in RFCOMM bind callback 2016-11-20 01:17:37 +00:00
6lowpan.c Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next 2014-06-05 14:10:07 -04:00
6lowpan.h Bluetooth: make bluetooth 6lowpan as an option 2014-03-11 07:54:55 -07:00
a2mp.c Bluetooth: Convert uses of __constant_<foo> to <foo> 2014-03-12 11:10:17 -07:00
a2mp.h Bluetooth: Move a2mp.h header file into net/bluetooth/ 2013-10-11 00:10:05 +02:00
af_bluetooth.c Bluetooth: Increase minor version of core module 2014-02-21 06:21:55 +02:00
amp.c Bluetooth: Remove l2cap_conn->dst usage from AMP manager 2013-10-13 17:43:32 +03:00
amp.h Bluetooth: Move amp.h header file into net/bluetooth/ 2013-10-11 00:10:03 +02:00
hci_conn.c Bluetooth: Fix LE connection timeout deadlock 2015-01-05 13:33:42 +00:00
hci_core.c Bluetooth: Make SMP context private to smp.c 2014-05-20 08:44:11 -07:00
hci_event.c Bluetooth: Fix using uninitialized variable when pairing 2014-09-17 09:22:14 -07:00
hci_sock.c Bluetooth: Fix user channel for 32bit userspace on 64bit kernel 2017-08-26 02:14:42 +01:00
hci_sysfs.c Bluetooth: Convert to use ATTRIBUTE_GROUPS macro 2014-02-13 09:51:34 +02:00
Kconfig Bluetooth: make sure 6LOWPAN_IPHC is built-in if needed 2014-03-13 07:05:10 -07:00
l2cap_core.c Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt 2019-05-02 21:42:03 +01:00
l2cap_sock.c Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU 2016-11-20 01:16:52 +00:00
lib.c Bluetooth: Add error mapping for Directed Advertising Timeout 2014-03-26 09:31:36 -07:00
Makefile Bluetooth: make bluetooth 6lowpan as an option 2014-03-11 07:54:55 -07:00
mgmt.c Bluetooth: Fix locking of hdev when calling into SMP code 2014-06-13 13:32:29 +02:00
sco.c bluetooth: Validate socket address length in sco_sock_bind(). 2016-01-04 17:20:47 +00:00
smp.c Bluetooth: use constant time memory comparison for secret values 2017-10-12 15:27:47 +01:00
smp.h Bluetooth: Make SMP context private to smp.c 2014-05-20 08:44:11 -07:00