Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom. KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one. The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds. Pull the transaction header with skb_pull_data() and discard frames that do not contain it.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 238c333bc4b3f245c626632e8bfa3c9dab97f51b; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 567a2a0a633f2ea5fdccaf3517c09f22c9d860c7; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 97b61241ab45bfa5b0526cb0f3978942493bc811; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2ebf63aa557a69990b4e9ea22be224d58aabce96; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 854194494a6f726a60b90b76059148bf08df023d; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 47778d2c2087b5d192398f6fddf692d16a5431cf |
| Linux / Linux | affected 2.6.12; unaffected 0 before 2.6.12; unaffected 5.10.266 through 5.10.*; unaffected 5.15.216 through 5.15.*; unaffected 6.1.183 through 6.1.*; unaffected 6.6.151 through 6.6.*; unaffected 6.12.103 through 6.12.*; unaffected 6.18.44 through 6.18.*; unaffected 7.1.8 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8
- https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b
- https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7
- https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec
- https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811
- https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96
- https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d
- https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf
ADP enrichment
No English description supplied.
No references supplied.