In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: Bluetooth: L2CAP: Corrección para aceptar múltiples L2CAP_ECRED_CONN_REQ Actualmente, el código intenta aceptar solicitudes independientemente del identificador de comando, lo que puede hacer que múltiples solicitudes se marquen como pendientes (FLAG_DEFER_SETUP), lo que puede causar que se asignen más de L2CAP_ECRED_MAX_CID(5) en l2cap_ecred_rsp_defer, causando un desbordamiento. La especificación es bastante clara en que el mismo identificador no debe usarse en solicitudes subsiguientes: 'Dentro de cada canal de señalización se utilizará un identificador diferente para cada solicitud o indicación sucesiva.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d Así que esto intenta verificar si hay canales pendientes con el mismo identificador y los rechaza si se encuentra alguno.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3853fb000> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd360289400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a081080> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384690e80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3853faa40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3853fa600> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384e13d40> | Operating System |
| linux | linux_kernel | 5.7 | <built-in method update of dict object at 0x7fd341257040> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36971e700> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd3853f8580> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36971c440> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36028a400> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd2dbe0f100> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36971e200> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd2dbe0d600> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |