In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255<\/p>\n
mgmt_hci_cmd_sync() checks that the message length agrees with params_len
\nbut puts no upper bound on it. params_len is __le16 while the parameter
\nlength in the HCI command header is a u8:<\/p>\n
\tstruct hci_command_hdr {
\n\t\t__le16\topcode;
\n\t\t__u8\tplen;
\n\t} __packed;<\/p>\n
hci_cmd_sync_alloc() assigns one to the other:<\/p>\n
\thdr->plen = plen;<\/p>\n
\tif (plen)
\n\t\tskb_put_data(skb, param, plen);<\/p>\n
so a params_len of 256 leaves plen at 0 while all 256 bytes are still
\nappended. The frame handed to the driver then declares no parameters and
\ncarries 256 of them. On a length framed transport such as H:4 the
\ncontroller takes the trailing bytes as the start of the next packet.<\/p>\n
The mgmt socket MTU is HCI_MAX_FRAME_SIZE, so params_len can reach about
\n1KB this way. Commit 03f1700b9b4d (“Bluetooth: MGMT: reject malformed
\nHCI_CMD_SYNC commands”) only made params_len agree with the message
\nlength, a value that fits the message but not the header field is still
\naccepted.<\/p>\n
Reject params_len that does not fit the header field.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255<\/p>\n
mgmt_hci_cmd_sync() checks that the message length agrees with params_le<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17264","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}