Apache NimBLE NULL Pointer Dereference Vulnerability in HCI Layer

A NULL pointer dereference vulnerability exists in Apache NimBLE versions through 1.8.0. This issue arises from a lack of proper validation in the HCI connection completion and HCI command transmission buffer, potentially leading to a NULL pointer dereference. The vulnerability requires disabled assertions and a faulty Bluetooth controller, which is why it is considered to have a low severity.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, which can cause a program to crash or behave unexpectedly by attempting to access memory that is not allocated.

Remediation

Users are advised to upgrade to Apache NimBLE version 1.9.0, which addresses this vulnerability.