Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type. After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core. After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path. Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected cf2719a21fdb9d4c8e9c834d279163609bef575d before 149cfb42ad69c7964fd9f2c43831da9152007129; affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before 7b2d4c04816cdc887f472caaf7fc966cfc107e40; affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before 1e1e509b6fd2a42421745bbcd98bd16daad20904; affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before 2c1143564c71e7497b42d8360a8379ccbb011d3c; affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before 3485c7236c59c8c34a41af1c4b52982437554e79; affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before f743eab6486965f276c7e3f1700895f014fdc6db; affected 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be before daf23014e5d975e72ea9c02b5160d3fcf070ea47; affected 9b67438e315b925a699f0178f4a48baf3d2d6ef4; affected 5.15.78 before 5.15.209; affected 6.0.8 before 6.1 |
| Linux / Linux | affected 6.1; unaffected 0 before 6.1; unaffected 5.15.209 through 5.15.*; unaffected 6.1.175 through 6.1.*; unaffected 6.6.140 through 6.6.*; unaffected 6.12.88 through 6.12.*; unaffected 6.18.30 through 6.18.*; unaffected 7.0.7 through 7.0.*; unaffected 7.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/149cfb42ad69c7964fd9f2c43831da9152007129
- https://git.kernel.org/stable/c/7b2d4c04816cdc887f472caaf7fc966cfc107e40
- https://git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904
- https://git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c
- https://git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79
- https://git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db
- https://git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47