archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-09 18:16:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/net/bluetooth
History
Ilia Gavrilov 8d59fba493 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 
In the parse_adv_monitor_pattern() function, the value of
the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).
The size of the 'value' array in the mgmt_adv_pattern structure is 31.
If the value of 'pattern[i].length' is set in the user space
and exceeds 31, the 'patterns[i].value' array can be accessed
out of bound when copied.

Increasing the size of the 'value' array in
the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset'
and 'length' back to the value of HCI_MAX_AD_LENGTH.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: db08722fc7 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-10-31 12:43:05 -04:00
..
bnep Bluetooth: bnep: fix wild-memory-access in proto_unregister 2024-10-16 16:10:03 -04:00
cmtp Bluetooth: CMTP: Mark BT_CMTP as DEPRECATED 2024-09-10 13:07:08 -04:00
hidp treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
rfcomm Bluetooth: rfcomm: fix modem control handling 2025-10-24 10:32:19 -04:00
6lowpan.c Bluetooth: L2CAP: add TX timestamping 2025-03-25 12:50:35 -04:00
af_bluetooth.c Bluetooth: ISO: add socket option to report packet seqnum via CMSG 2025-07-23 10:31:19 -04:00
aosp.c Bluetooth: aosp: Fix typo in comment 2025-07-23 10:30:18 -04:00
aosp.h Bluetooth: aosp: Support AOSP Bluetooth Quality Report 2021-11-02 19:37:52 +01:00
coredump.c Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv 2025-07-23 10:33:57 -04:00
ecdh_helper.c Bluetooth: Use crypto_wait_req 2023-02-13 18:34:48 +08:00
ecdh_helper.h Fix misc new gcc warnings 2021-04-27 17:05:53 -07:00
eir.c Bluetooth: eir: Fix possible crashes on eir_create_adv_data 2025-06-11 16:29:22 -04:00
eir.h Bluetooth: eir: Fix possible crashes on eir_create_adv_data 2025-06-11 16:29:22 -04:00
hci_codec.c Bluetooth: Fix support for Read Local Supported Codecs V2 2022-12-02 13:09:31 -08:00
hci_codec.h Bluetooth: Add support for Read Local Supported Codecs V2 2021-09-07 14:09:18 -07:00
hci_conn.c Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS 2025-10-24 10:31:41 -04:00
hci_core.c Bluetooth: hci_core: Print information of hcon on hci_low_sent 2025-09-27 11:37:01 -04:00
hci_debugfs.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
hci_debugfs.h Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c 2021-09-22 16:17:13 +02:00
hci_drv.c Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
hci_event.c Bluetooth: hci_event: validate skb length for unknown CC opcode 2025-10-31 12:41:01 -04:00
hci_sock.c Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() 2025-07-23 10:25:34 -04:00
hci_sync.c Bluetooth: hci_core: Fix tracking of periodic advertisement 2025-10-24 10:31:59 -04:00
hci_sysfs.c Bluetooth: Allow reset via sysfs 2025-01-15 10:37:07 -05:00
iso.c Bluetooth: ISO: Fix another instance of dst_type handling 2025-10-24 10:30:50 -04:00
Kconfig Bluetooth: Remove BT_HS 2024-03-06 17:22:39 -05:00
l2cap_core.c Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" 2025-10-24 10:30:30 -04:00
l2cap_sock.c Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() 2025-08-29 14:51:06 -04:00
leds.c Bluetooth: Use led_set_brightness() in LED trigger activate() callback 2024-09-10 13:06:11 -04:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: Fix typos in comments 2025-07-23 10:30:48 -04:00
Makefile Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
mgmt.c Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 2025-10-31 12:43:05 -04:00
mgmt_config.c Bluetooth: Avoid a couple dozen -Wflex-array-member-not-at-end warnings 2025-09-27 11:37:43 -04:00
mgmt_config.h Bluetooth: mgmt: Add commands for runtime configuration 2020-06-18 13:11:03 +03:00
mgmt_util.c Bluetooth: MGMT: Fix possible UAFs 2025-09-22 10:30:00 -04:00
mgmt_util.h Bluetooth: MGMT: Fix possible UAFs 2025-09-22 10:30:00 -04:00
msft.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
msft.h Bluetooth: msft: fix slab-use-after-free in msft_do_close() 2024-05-03 13:05:28 -04:00
sco.c Bluetooth: SCO: Fix UAF on sco_conn_free 2025-09-27 11:37:43 -04:00
selftest.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
selftest.h Bluetooth: Add support for self testing framework 2014-12-30 08:53:55 +02:00
smp.c Bluetooth: Fix typos in comments 2025-07-23 10:30:48 -04:00
smp.h Bluetooth: SMP: If an unallowed command is received consider it a failure 2025-07-16 15:33:30 -04:00