Commit a2045d57 authored Oct 31, 2022 by Luiz Augusto von Dentz Committed by Greg Kroah-Hartman Dec 08, 2022

Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM



commit 711f8c3fb3db61897080468586b970c87c61d9e4 upstream.

The Bluetooth spec states that the valid range for SPSM is from
0x0001-0x00ff so it is invalid to accept values outside of this range:

  BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
  page 1059:
  Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges

CVE: CVE-2022-42896
CC: stable@vger.kernel.org
Reported-by: Tamás Koczka <poprdi@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reviewed-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 6960c31d

net/bluetooth/l2cap_core.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -5553,6 +5553,19 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
		BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
		scid, mtu, mps);

		/* BLUETOOTH CORE SPECIFICATION Version 5.3 \| Vol 3, Part A
		* page 1059:
		*
		* Valid range: 0x0001-0x00ff
		*
		* Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
		*/
		if (!psm \|\| __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
		result = L2CAP_CR_BAD_PSM;
		chan = NULL;
		goto response;
		}

		/* Check if we have socket listening on psm */
		pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
		&conn->hcon->dst, LE_LINK);