Soenke Huster

A list management bug in BSS handling in the mac80211 stack could be used by local attackers to corrupt a linked list and potentially execute code. The issue is related to a logic error in the code, which could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

The issue allows local attackers to inject WLAN frames into the mac80211 stack, potentially causing a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. This could lead to a denial-of-service condition.

The issue is related to refcounting bugs in the multi-BSS handling in the mac80211 stack, which could allow local attackers to trigger use-after-free conditions and potentially execute code by injecting WLAN frames. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

A use-after-free issue in the mac80211 stack when parsing a multi-BSSID element could be exploited by attackers able to inject WLAN frames to crash the kernel and potentially execute code. This issue is related to a logic error in the code, specifically in the `ieee802 11 parse elems crc` function of `util.c`, which could lead to remote code execution without additional execution privileges needed. User interaction is not required for exploitation.

A null pointer dereference issue has been identified in the Linux kernel related to Bluetooth functionality. Specifically, this issue occurs when a HCI Synchronous Connection Complete event is received for a BDADDR of an existing LE connection with a status that triggers a particular case of packet processing, resulting in a null pointer dereference because `conn->link` is NULL. This event is specified for SCO and eSCO link types.

A memory corruption issue exists due to the registration of devices multiple times when multiple connection complete events are received for the same handle. To address this, the code now ignores consequent events for a single connection. The introduction of HCI CONN HANDLE UNSET helps identify new connections, and checks for HCI CONN HANDLE MAX prevent the use of invalid handles.