Impact Analysis

This vulnerability can cause the Linux kernel Bluetooth subsystem to enter an infinite loop while holding a device lock, potentially leading to a denial of service (DoS) condition where Bluetooth functionality becomes unresponsive or the system's Bluetooth resources are locked.

Additionally, the out-of-bounds read accesses adjacent heap memory, which could lead to memory corruption or instability in the kernel, further impacting system reliability and security.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by fixing the Linux kernel Bluetooth code to properly terminate the BIG if not all BIS could be set up properly.

Therefore, the immediate mitigation step is to update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth subsystem, specifically in the function hci_le_create_big_complete_evt(). The function iterates over BT_BOUND connections for a BIG handle using a while loop, accessing an array ev->bis_handle without checking if the index stays within the valid range ev->num_bis.

If a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than expected or with num_bis set to zero, the loop reads beyond the valid bis_handle array into adjacent heap memory. This out-of-bounds read can cause the connection to remain in a BT_BOUND state and triggers an infinite loop while holding a device lock.

The issue is fixed by terminating the BIG if not all BIS could be set up properly, preventing the out-of-bounds read and infinite loop.

Useful 0 Not Useful 0