Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/include/net/bluetooth
History
Ilia Gavrilov 8d59fba493 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 
In the parse_adv_monitor_pattern() function, the value of
the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).
The size of the 'value' array in the mgmt_adv_pattern structure is 31.
If the value of 'pattern[i].length' is set in the user space
and exceeds 31, the 'patterns[i].value' array can be accessed
out of bound when copied.

Increasing the size of the 'value' array in
the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset'
and 'length' back to the value of HCI_MAX_AD_LENGTH.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: db08722fc7 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
 		2025-10-31 12:43:05 -04:00
..
bluetooth.h Bluetooth: Add function and line information to bt_dbg 2025-09-27 11:37:01 -04:00
coredump.h
…
hci.h Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 2025-10-24 10:21:07 -04:00
hci_core.h Bluetooth: hci_core: Fix tracking of periodic advertisement 2025-10-24 10:31:59 -04:00
hci_drv.h Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le() 2025-09-27 11:37:00 -04:00
hci_mon.h Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
hci_sock.h
…
hci_sync.h Bluetooth: hci_sync: fix set_local_name race condition 2025-08-22 13:57:31 -04:00
iso.h
…
l2cap.h Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" 2025-10-24 10:30:30 -04:00
mgmt.h Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 2025-10-31 12:43:05 -04:00
rfcomm.h
…
sco.h
…