Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth L2CAP component, specifically in the function l2cap_ecred_data_rcv(). The function reads the SDU length field from a data buffer without first verifying that the buffer contains enough data (at least 2 bytes). If the buffer length is less than 2 bytes, the function reads beyond the valid data, which can lead to memory corruption or other unexpected behavior.

The issue arises because l2cap_ecred_data_rcv() uses get_unaligned_le16() to read the SDU length without checking the buffer length first. In contrast, another path in the code (ERTM reassembly) correctly validates the buffer length before reading. The fix involves applying the same validation to the Enhanced Credit Based Flow Control data path.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to reading beyond the valid data in a buffer, which may cause memory corruption. Such memory corruption can potentially be exploited to cause crashes, denial of service, or even arbitrary code execution depending on the context and attacker capabilities.

Useful 0 Not Useful 0