A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
The product reads data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8rpp-6vxq-pqg3 | third party advisory exploit |