Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt().
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 before 1e4b738dd0d0f7b237686167706badad9d30649c; affected 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 before ac7889b0fe441e4ef892c40b1d002e91f93fa4ae; affected 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 before dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2; affected 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 before 86c8d07a64d553c41e213b52650020010f9ef23e; affected 2f20216c1d6fe17c1a224f658be0dc6fab2269c7 before 2b2bf47cd75518c36fa2d41380e4a40641cc89cd |
| Linux / Linux | affected 5.10; unaffected 0 before 5.10; unaffected 6.6.160 through 6.6.*; unaffected 6.12.114 through 6.12.*; unaffected 6.18.57 through 6.18.*; unaffected 6.19.12 through 6.19.*; unaffected 7.0 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c
- https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae
- https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2
- https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e
- https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd
ADP enrichment
No English description supplied.
No references supplied.