Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.5, 6.6, 6.6.140, 6.12.88, 6.18.30, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From a0bfde167b506423111ddb8cd71930497a40fc54 · fixed in 6cb7f67bc28da787499291a562d49a084d9c90cd; From a0bfde167b506423111ddb8cd71930497a40fc54 · fixed in 22559ad7654f61727fc270ee4893da9f4b70cf17; From a0bfde167b506423111ddb8cd71930497a40fc54 · fixed in 77981a507aa0fc001dc37f0dd6631dd2042fed17; From a0bfde167b506423111ddb8cd71930497a40fc54 · fixed in 665da0baaf0396f9ed3c86ccb3955dcd0b73e774; From a0bfde167b506423111ddb8cd71930497a40fc54 · fixed in 5ddb8014261137cadaf83ab5617a588d80a22586; From 6.4.16 · fixed in 6.5; From 6.5.3 · fixed in 6.6
- Linux Linux
6.6
- KernelLinux
From 6.6.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.88; From 6.13.0 · fixed in 6.18.30; From 6.19.0 · fixed in 7.0.7