kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/include/net/bluetooth
History
Ilia Gavrilov 96616530f5 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 
commit 8d59fba493 upstream.

In the parse_adv_monitor_pattern() function, the value of
the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).
The size of the 'value' array in the mgmt_adv_pattern structure is 31.
If the value of 'pattern[i].length' is set in the user space
and exceeds 31, the 'patterns[i].value' array can be accessed
out of bound when copied.

Increasing the size of the 'value' array in
the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset'
and 'length' back to the value of HCI_MAX_AD_LENGTH.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: db08722fc7 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-12-07 06:12:30 +09:00
..
bluetooth.h Bluetooth: SCO: Add support for 16 bits transparent voice setting 2024-12-19 18:08:57 +01:00
hci.h Bluetooth: ISO: Add support for periodic adv reports processing 2025-12-07 06:12:12 +09:00
hci_core.h Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync 2025-10-02 13:40:39 +02:00
hci_mon.h Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name 2023-10-25 12:03:16 +02:00
hci_sock.h Bluetooth: Fix HCIGETDEVINFO regression 2022-09-08 14:33:53 -07:00
hci_sync.h Bluetooth: hci_sync: fix set_local_name race condition 2025-09-04 15:26:27 +02:00
iso.h Bluetooth: ISO: Add broadcast support 2022-07-22 17:14:13 -07:00
l2cap.h Bluetooth: compute LE flow credits based on recvbuf space 2024-06-12 11:03:20 +02:00
mgmt.h Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 2025-12-07 06:12:30 +09:00
rfcomm.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
sco.h Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections 2020-06-12 15:08:49 +02:00