android_kernel_samsung_msm8226-rubenslte

rubenslte/android_kernel_samsung_msm8226-rubenslte

forked from rubenslte/android_kernel_samsung_msm8226

Files

T

Young Xiao 6e214c858f Bluetooth: hidp: fix buffer overflow

commit a1616a5ac99ede5d605047a9012481ce7ff18b16 upstream.

Struct ca is copied from userspace. It is not checked whether the "name"
field is NULL terminated, which allows local users to obtain potentially
sensitive information from kernel stack memory, via a HIDPCONNADD command.

This vulnerability is similar to CVE-2011-1079.

Signed-off-by: Young Xiao <YangX92@hotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2019-11884
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: If26bd0108596f42bb48349146f0c84eb0a675276

2019-08-09 12:05:04 +02:00

bnep

Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket

2019-08-08 15:03:05 +02:00

cmtp

Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket

2019-08-08 15:03:04 +02:00

hidp

Bluetooth: hidp: fix buffer overflow

2019-08-09 12:05:04 +02:00

rfcomm

Bluetooth: Add sockaddr length checks before accessing sa_family in bind and connect handlers