Google GitGoogle Git
Sign in
pigweed/pigweed/sandbox/be0ce381cb18a4ea0c3cd1f9eb7f559bffcc8fde
commit
be0ce381cb18a4ea0c3cd1f9eb7f559bffcc8fde
[log]
author
Devan Yu <devanyu@google.com>
Sat Sep 26 05:07:31 2026 -0700
committer
CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com>
Sat Sep 26 05:07:31 2026 -0700
tree
fcc49423267512bee77f142963dce9d3c5e988d4
parent
9de9ebb99b39a2a56cea3ff6edb70a49d10042c1 [diff]
pw_bluetooth_sapphire: Fix UAF in `EnableEncryption`

Fix a Use-After-Free (UAF) vulnerability in
`SecureSimplePairingState::EnableEncryption` and
`LegacyPairingState::EnableEncryption` by updating the internal state
before invoking the status callback. This means that no member variables
are accessed after the callback deallocates the pairing state object.

Fixed: b/512561259
Fixed: b/535176265
Change-Id: I1318ad0de02274ed7de95fce454993c9257471fe
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/482641
4 files changed
tree: fcc49423267512bee77f142963dce9d3c5e988d4
  1. .agents/
  2. .allstar/
  3. .gemini/
  4. .github/
  5. .vscode/
  6. build_overrides/
  7. docker/
  8. docs/
  9. kudzu/
  10. pw_alignment/
  11. pw_allocator/
  12. pw_allocator_zephyr/
  13. pw_analog/
  14. pw_android_toolchain/
  15. pw_arduino_build/
  16. pw_assert/
  17. pw_assert_basic/
  18. pw_assert_fuchsia/
  19. pw_assert_log/
  20. pw_assert_tokenized/
  21. pw_assert_trap/
  22. pw_assert_zephyr/
  23. pw_async/
  24. pw_async2/
  25. pw_async_basic/
  26. pw_async_fuchsia/
  27. pw_atomic/
  28. pw_base64/
  29. pw_bloat/
  30. pw_blob_store/
  31. pw_bluetooth/
  32. pw_bluetooth_hci/
  33. pw_bluetooth_profiles/
  34. pw_bluetooth_proxy/
  35. pw_bluetooth_sapphire/
  36. pw_boot/
  37. pw_boot_cortex_m/
  38. pw_buf/
  39. pw_build/
  40. pw_build_android/
  41. pw_build_info/
  42. pw_build_mcuxpresso/
  43. pw_bytes/
  44. pw_change/
  45. pw_channel/
  46. pw_checksum/
  47. pw_chre/
  48. pw_chrono/
  49. pw_chrono_embos/
  50. pw_chrono_freertos/
  51. pw_chrono_rp2040/
  52. pw_chrono_stl/
  53. pw_chrono_threadx/
  54. pw_chrono_zephyr/
  55. pw_cli/
  56. pw_cli_analytics/
  57. pw_clock_tree/
  58. pw_clock_tree_mcuxpresso/
  59. pw_compilation_testing/
  60. pw_config_loader/
  61. pw_console/
  62. pw_containers/
  63. pw_cpu_exception/
  64. pw_cpu_exception_cortex_m/
  65. pw_cpu_exception_risc_v/
  66. pw_crypto/
  67. pw_digital_io/
  68. pw_digital_io_linux/
  69. pw_digital_io_mcuxpresso/
  70. pw_digital_io_rp2040/
  71. pw_digital_io_zephyr/
  72. pw_display/
  73. pw_dma_mcuxpresso/
  74. pw_docgen/
  75. pw_doctor/
  76. pw_elf/
  77. pw_emu/
  78. pw_enum/
  79. pw_env_setup/
  80. pw_env_setup_zephyr/
  81. pw_file/
  82. pw_flatbuffers/
  83. pw_format/
  84. pw_fortifier/
  85. pw_function/
  86. pw_fuzzer/
  87. pw_ghish/
  88. pw_grpc/
  89. pw_hdlc/
  90. pw_hex_dump/
  91. pw_i2c/
  92. pw_i2c_linux/
  93. pw_i2c_mcuxpresso/
  94. pw_i2c_rp2040/
  95. pw_i2c_zephyr/
  96. pw_ide/
  97. pw_interrupt/
  98. pw_interrupt_cortex_m/
  99. pw_interrupt_freertos/
  100. pw_interrupt_zephyr/
  101. pw_intrusive_ptr/
  102. pw_json/
  103. pw_kernel/
  104. pw_kvs/
  105. pw_libc/
  106. pw_libcxx/
  107. pw_log/
  108. pw_log_android/
  109. pw_log_basic/
  110. pw_log_fuchsia/
  111. pw_log_null/
  112. pw_log_rpc/
  113. pw_log_string/
  114. pw_log_tokenized/
  115. pw_log_zephyr/
  116. pw_malloc/
  117. pw_malloc_freelist/
  118. pw_malloc_freertos/
  119. pw_memory/
  120. pw_metric/
  121. pw_module/
  122. pw_multibuf/
  123. pw_multisink/
  124. pw_numeric/
  125. pw_package/
  126. pw_perf_test/
  127. pw_persistent_ram/
  128. pw_polyfill/
  129. pw_preprocessor/
  130. pw_presubmit/
  131. pw_protobuf/
  132. pw_protobuf_compiler/
  133. pw_random/
  134. pw_random_fuchsia/
  135. pw_result/
  136. pw_ring_buffer/
  137. pw_router/
  138. pw_rpc/
  139. pw_rpc2/
  140. pw_rpc_transport/
  141. pw_rust/
  142. pw_sensor/
  143. pw_snapshot/
  144. pw_software_update/
  145. pw_span/
  146. pw_spi/
  147. pw_spi_linux/
  148. pw_spi_mcuxpresso/
  149. pw_spi_rp2040/
  150. pw_spi_zephyr/
  151. pw_status/
  152. pw_stm32cube_build/
  153. pw_stream/
  154. pw_stream_uart_linux/
  155. pw_stream_uart_mcuxpresso/
  156. pw_string/
  157. pw_symbolizer/
  158. pw_sync/
  159. pw_sync_baremetal/
  160. pw_sync_embos/
  161. pw_sync_freertos/
  162. pw_sync_stl/
  163. pw_sync_threadx/
  164. pw_sync_zephyr/
  165. pw_sys_io/
  166. pw_sys_io_ambiq_sdk/
  167. pw_sys_io_arduino/
  168. pw_sys_io_baremetal_lm3s6965evb/
  169. pw_sys_io_baremetal_stm32f429/
  170. pw_sys_io_emcraft_sf2/
  171. pw_sys_io_mcuxpresso/
  172. pw_sys_io_rp2040/
  173. pw_sys_io_stdio/
  174. pw_sys_io_stm32cube/
  175. pw_sys_io_zephyr/
  176. pw_system/
  177. pw_target_runner/
  178. pw_thread/
  179. pw_thread_embos/
  180. pw_thread_freertos/
  181. pw_thread_stl/
  182. pw_thread_threadx/
  183. pw_thread_zephyr/
  184. pw_time/
  185. pw_tls_client/
  186. pw_tls_client_boringssl/
  187. pw_tls_client_mbedtls/
  188. pw_tokenizer/
  189. pw_toolchain/
  190. pw_trace/
  191. pw_trace_tokenized/
  192. pw_transfer/
  193. pw_transport/
  194. pw_uart/
  195. pw_uart_mcuxpresso/
  196. pw_unit_test/
  197. pw_uuid/
  198. pw_varint/
  199. pw_watch/
  200. pw_web/
  201. pw_work_queue/
  202. seed/
  203. targets/
  204. third_party/
  205. zephyr/
  206. .dockerignore ⇨ .gitignore
  207. activate.fish ⇨ bootstrap.fish
  208. activate.sh ⇨ bootstrap.sh
  209. .bazelignore
  210. .bazelrc
  211. .bazelversion
  212. .black.toml
  213. .clang-format
  214. .clang-tidy
  215. .git-blame-ignore-revs
  216. .gitattributes
  217. .gitignore
  218. .gn
  219. .mypy.ini
  220. .prettierignore
  221. .prettierrc.cjs
  222. .pw_ide.yaml
  223. .pylintrc
  224. .rgignore
  225. .ruff.toml
  226. activate.bat
  227. Android.bp
  228. AUTHORS
  229. bootstrap.bat
  230. bootstrap.fish
  231. bootstrap.sh
  232. BUILD.bazel
  233. BUILD.gn
  234. BUILDCONFIG.gn
  235. CMakeLists.txt
  236. EXTENDED_OWNERS
  237. GEMINI.md
  238. gh
  239. go.mod
  240. go.sum
  241. Kconfig.zephyr
  242. LICENSE
  243. MODULE.bazel
  244. MODULE.bazel.lock
  245. modules.gni
  246. OWNERS
  247. package.json
  248. pigweed.json
  249. PIGWEED_MODULES
  250. pw
  251. README.md
  252. REPO.bazel
  253. rustfmt.toml
  254. tsconfig.json
  255. workflows.json
  256. WORKSPACE_OWNERS
README.md

Pigweed

Pigweed is an open source collection of embedded-targeted libraries–or as we like to call them, modules. These modules are building blocks and infrastructure that enable faster and more reliable development on small-footprint MMU-less 32-bit microcontrollers like the STMicroelectronics STM32L452 or the Nordic nRF52832.

For more information please see our website: https://pigweed.dev/.

Links