Vulnerability feed

Executive summary

A flaw in the Infineon PSOC 6 BLESS Bluetooth HCI driver for Linux can cause concurrent transmissions to share a single packet descriptor, which may leak nearby device memory contents to a connected Bluetooth peer. The advisory describes the impact as information disclosure and link disruption, with no memory corruption or code execution. The advisory does not state a severity score, and it does not describe a vendor-issued fixed release, only the code change that removes the shared state.

Technical summary

This is a race condition (concurrent access to shared state without adequate locking) in the driver's TX path, where a file-scope HCI packet descriptor is populated before the serialising semaphore is acquired. The condition is reached when the Bluetooth host sends HCI traffic from a second thread, such as through the ACL buffer destroy callback when an application uses -EINPROGRESS and bt_l2cap_chan_recv_complete(), and a remote peer generating traffic raises the collision rate. The result can be disclosure of adjacent RAM up to a full HCI/ACL payload to the connected peer, or duplicated and dropped HCI packets. The advisory states that the driver only reads through the shared descriptor and that the disclosed bytes are not attacker-chosen. Affected and fixed version numbers are not stated, and no workaround is stated beyond the code fix that makes the descriptor a local variable. No detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affects

zephyrprojectInfineonzephyrproject zephyrInfineon PSOC 6 BLESS HCI driver