CVE-2023-1902

The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
Configurations

Configuration 1 (hide)

cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

History

07 Nov 2024, 16:35

Type Values Removed Values Added
CWE CWE-672

17 Jul 2023, 13:45

Type Values Removed Values Added
First Time Zephyrproject zephyr
Zephyrproject
CPE cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.0
CWE CWE-416
References (MISC) https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899 - (MISC) https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899 - Vendor Advisory

10 Jul 2023, 16:27

Type Values Removed Values Added
New CVE

Information

Published : 2023-07-10 16:15

Updated : 2024-11-07 16:35


NVD link : CVE-2023-1902

Mitre link : CVE-2023-1902

CVE.ORG link : CVE-2023-1902


JSON object : View

Products Affected

zephyrproject

  • zephyr
CWE
CWE-416

Use After Free

CWE-672

Operation on a Resource after Expiration or Release