Hui Peng

A flaw exists in the Android operating system's Bluetooth stack, specifically within the `build read multi rsp` function of `gatt sr.cc`. This issue is due to insufficient input validation, leading to a heap buffer overflow and a potential integer underflow. Successful exploitation allows a remote attacker to execute arbitrary code without requiring user interaction or authentication. The vulnerability resides in the handling of the GATT REQ READ MULTI VAR opcode. The vulnerability can lead to a denial-of-service or, under favorable conditions, remote code execution within the Bluetooth daemon. Exploitation involves crafting and sending specially designed Read Multiple requests that cause the `build read multi rsp()` function to incorrectly calculate the total response size, resulting in a heap corruption. The vulnerability has been demonstrated on devices using Jemalloc (Xiaomi 12T) and Scudo (Samsung A54).

In the `eatt l2cap reconfig completed` function of `eatt impl.h`, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

The issue is related to the `l2cap sock release` function in the Linux kernel, specifically in the `net/bluetooth/l2cap sock.c` file. It involves a use-after-free error because the children of an `sk` are mishandled. This could potentially allow an attacker to cause a denial of service or have other impacts.

The `GatherNd` function in TensorFlow takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been reported by Hui Peng from Baidu Security.

The `ScatterNd` function in TensorFlow takes an input argument that determines the indices of the output tensor. If the input index is greater than the output tensor or less than zero, it can either write content at the wrong index or trigger a crash.

TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.

The issue is related to a Double Free error in the Linux kernel, specifically in the drivers/net/wireless/rsi/rsi 91x usb.c file. This error can be triggered by crafted USB device traffic, which may be remote via usbip or usbredir, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to the `check input term` function in the `sound/usb/mixer.c` file of the Linux kernel, which mishandles recursion. This leads to kernel stack exhaustion.

The issue is related to the `parse audio mixer unit` function in the `sound/usb/mixer.c` file of the Linux kernel, which mishandles a short descriptor, leading to out-of-bounds memory access. This can potentially allow an attacker to access confidential information or cause a denial of service.

The issue is related to a driver error in the Linux kernel, specifically in the `drivers/net/wireless/ath/ath6kl/usb.c` file, which is associated with NULL pointer dereference errors. This can be exploited by an attacker to cause a denial of service. The error occurs due to an incomplete address in an endpoint descriptor.

The issue is related to the function `hso get config data` in the Linux kernel, which reads data from a USB device and uses it to index an array. This can result in an object out-of-bounds read, potentially allowing arbitrary read access in the kernel address space. The vulnerability may be exploited to cause a denial of service.

The issue is related to a use-after-free in the ALSA driver. A local user could exploit this by supplying a malicious USB Sound device that is mishandled in the `usb audio probe` function in `sound/usb/card.c`. This could allow an attacker to execute arbitrary code or cause a denial of service.

An issue in the Linux kernel's USB subsystem mishandles size checks during the reading of an extra descriptor, related to the ` usb get extra descriptor` function in `drivers/usb/core/usb.c`. This issue may allow an attacker to impact the confidentiality and integrity of protected information.