Eunkyu Lee

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions through 1.7.0 **Description** The issue is related to improper validation of array indices in Apache NimBLE, which could result in out-of-bound memory corruption and crash due to lack of input validation for HCI events from the controller. This problem requires a broken or bogus Bluetooth controller and is considered low severity. **Recommendations** For Apache NimBLE versions through 1.7.0, users are recommended to upgrade to version 1.8.0, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions through 1.7.0 **Description** The issue is an Out-of-bounds Read vulnerability in Apache NimBLE. It is caused by missing proper validation of the HCI advertising report, which could lead to out-of-bound access when parsing an HCI event, resulting in bogus GAP 'device found' events being sent. This issue requires a broken or bogus Bluetooth controller and is considered low severity. **Recommendations** For Apache NimBLE versions through 1.7.0, users are recommended to upgrade to version 1.8.0, which fixes the issue. As a temporary workaround, consider restricting the use of the HCI advertising report functionality until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions through 1.7.0 **Description** The issue is an Out-of-bounds Read vulnerability in Apache NimBLE. It is caused by missing proper validation of HCI Number Of Completed Packets, which could lead to out-of-bound access when parsing HCI events and invalid read from HCI transport memory. This issue requires a broken or bogus Bluetooth controller and is considered low severity. **Recommendations** For Apache NimBLE versions through 1.7.0, users are recommended to upgrade to version 1.8.0, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Huawei P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) Huawei P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) **Description** The issue is related to a message replay vulnerability in some Huawei 4G LTE devices. These devices implement a less strict check on the NAS message sequence number, specifically NAS COUNT, for better compatibility. This allows an attacker to construct a rogue base station and replay certain messages, such as the GUTI reallocation command message or the Identity request message, under specific conditions. This can result in tampering with GUTIs or obtaining IMSIs. **Recommendations** For Huawei P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), update to version ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) or later. For Huawei P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), update to version VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) or later.