Summary

An improper discarding routine causes a heap overflow in bt_hci_le_adv_ext_report in /subsys/bluetooth/host/scan.c.

Details

After pulling bt_hci_evt_le_ext_advertising_info from the buffer, it sometimes proceeds to the cont routine based on event types and states.

		...

		if (buf->len < sizeof(*evt)) {
			LOG_ERR("Unexpected end of buffer");
			break;
		}
		...
		
		if (evt_type & BT_HCI_LE_ADV_EVT_TYPE_LEGACY) {
			/* Legacy advertising reports are complete.
			 * Create event immediately.
			 */
			create_ext_adv_info(evt, &scan_info);
			le_adv_recv(&evt->addr, &scan_info, &buf->b, evt->length);
			goto cont;
		}

		...

cont:
		net_buf_pull(buf, evt->length);

In cont routine, there is no length check of remaining buffer before pulling data, causing under wrap of the buffer length. This bypasses the next check of the remaining buffer size, directly leading to a heap overflow.

PoC

Set the number of reports to a value other than 0 to enter the while loop.

The remaining buffer after pulling 1 byte should be larger than sizeof(*evt) which is 24 bytes.

Set the evt_type of first bt_hci_evt_le_ext_advertising_info to BT_HCI_LE_ADV_EVT_TYPE_LEGACY, which is BIT(4).

evt->length can vary depending on input length.

Impact

Result of exploitation could lead to instability (i.e., crash) or denial of service attacks.

Patches

main: #74639
v3.6: #77960

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2024-09-12