CVE-2021-47620

Bluetooth: refactor malicious adv data check

State: Published
Severity: 8.1 High
Published: Jun 20, 2024
Updated: Aug 5, 2026
Reserved: Jun 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: refactor malicious adv data check

Check for out-of-bound read was being performed at the end of while num_reports loop, and would fill journal with false positives. Added check to beginning of loop processing so that it doesn't get checked after ptr has been advanced.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	048acfa4daf167b007b6bd8bef474e90c2282a5f to before 305e92f525450f3e1b5f5c9dc7eadb152d66a082Affected 7d4238edd3bf8b8c75571cc3b382bc10438ac588 to before 7889b38a7f21ed19314f83194622b195d328465cAffected 185c77cbb53bc7481acc5a0b4e6119bbe393d561 to before 5a539c08d743d9910631448da78af5e961664c0eAffected 4a1491432394b22e585a185ffca49086e4046aae to before 8819f93cd4a443dfe547aa622b21f723757df3fbAffected 24161b9c43de966789d5956428f45002d10f878e to before 835d3706852537bf92eb23eb8635b8dee0c0aa67Affected ffc9019bd991707701273c2e5d8aed472229fc4d to before 83d5196b65d1b29e27d7dd16a3b9b439fb1d2dbaAffected 2de0e6a71ceb056e17e4684dce8b7640367996f9 to before bcea886771c3f22a590c8c8b9139a107bd7f1e1cAffected 640a476e38fce6c70c738ac09e5167e34f570303 to before 5c968affa804ba98c3c603f37ffea6fba618025eAffected 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 to before 899663be5e75dc0174dc8bda0b5e6826edf0b29aAffected
LinuxLinux	4.4.300 to before 4.4.302Affected 4.9.298 to before 4.9.300Affected 4.14.263 to before 4.14.265Affected 4.19.226 to before 4.19.228Affected 5.4.174 to before 5.4.176Affected 5.10.94 to before 5.10.96Affected 5.15.17 to before 5.15.19Affected 5.16.3 to before 5.16.5Affected

Product

Versions

LinuxLinux

048acfa4daf167b007b6bd8bef474e90c2282a5f to before 305e92f525450f3e1b5f5c9dc7eadb152d66a082Affected
7d4238edd3bf8b8c75571cc3b382bc10438ac588 to before 7889b38a7f21ed19314f83194622b195d328465cAffected
185c77cbb53bc7481acc5a0b4e6119bbe393d561 to before 5a539c08d743d9910631448da78af5e961664c0eAffected
4a1491432394b22e585a185ffca49086e4046aae to before 8819f93cd4a443dfe547aa622b21f723757df3fbAffected
24161b9c43de966789d5956428f45002d10f878e to before 835d3706852537bf92eb23eb8635b8dee0c0aa67Affected
ffc9019bd991707701273c2e5d8aed472229fc4d to before 83d5196b65d1b29e27d7dd16a3b9b439fb1d2dbaAffected
2de0e6a71ceb056e17e4684dce8b7640367996f9 to before bcea886771c3f22a590c8c8b9139a107bd7f1e1cAffected
640a476e38fce6c70c738ac09e5167e34f570303 to before 5c968affa804ba98c3c603f37ffea6fba618025eAffected
3a56ef719f0b9682afb8a86d64b2399e36faa4e6 to before 899663be5e75dc0174dc8bda0b5e6826edf0b29aAffected

LinuxLinux

4.4.300 to before 4.4.302Affected
4.9.298 to before 4.9.300Affected
4.14.263 to before 4.14.265Affected
4.19.226 to before 4.19.228Affected
5.4.174 to before 5.4.176Affected
5.10.94 to before 5.10.96Affected
5.15.17 to before 5.15.19Affected
5.16.3 to before 5.16.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.