Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth L2CAP implementation. It involves improper handling during the re-initialization of Enhanced Retransmission Mode (ERTM) resources when reconfiguring L2CAP channels that are already connected.

Specifically, the function l2cap_config_req() processes configuration requests for channels in the BT_CONNECTED state. Because certain flags are already set from the initial configuration, the code mistakenly re-initializes ERTM resources without freeing previously allocated memory, causing resource leaks.

Additionally, the function l2cap_parse_conf_req() does not validate a minimum value for the remote maximum PDU size (remote_mps). If this value is zero, it leads to an infinite loop in l2cap_segment_sdu() because the loop's termination condition is never met, which results in exhaustion of available memory.

The fix involves skipping the re-initialization steps when the channel is already connected, while still allowing configuration updates, and adding a check to prevent zero pdu_len values to avoid infinite loops.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory leaks and potentially cause the system to exhaust available memory due to an infinite loop triggered by a zero pdu_len value.

Such memory exhaustion can degrade system performance, cause instability, or lead to denial of service conditions in devices using the affected Linux kernel Bluetooth stack.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by skipping the re-initialization of ERTM resources when the channel is already in the BT_CONNECTED state, and by adding a zero check for pdu_len to prevent infinite loops.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0