Bluetooth: btmtk USB HCI WMT Event Length Validation Flaw

Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth component, specifically in the btmtk driver. The function btmtk_usb_hci_wmt_sync() improperly casts the WMT event response SKB data to certain structures without first verifying that the SKB contains enough data. This lack of validation can lead to out-of-bounds reads when the firmware response is shorter than expected.

The issue arises because the code assumes the SKB data length is sufficient for the structures it casts to, but if the data is shorter, it reads beyond the buffer's boundary, potentially causing memory access errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause out-of-bounds memory reads in the Linux kernel Bluetooth driver, which may lead to system instability, crashes, or potentially expose sensitive kernel memory contents.

While the description does not specify exploitation details, out-of-bounds reads can sometimes be leveraged by attackers to gain information about kernel memory layout or cause denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by validating the WMT event SKB length before struct access in the Linux kernel Bluetooth btmtk driver.

To mitigate this vulnerability immediately, update your Linux kernel to a version that includes the fix where skb_pull_data() is used to validate and advance past the base WMT event header, ensuring that the SKB contains enough data before accessing it.

Useful 0 Not Useful 0