Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth management code, specifically in the function that validates advertising data fields (TLV - Type Length Value). The function tlv_data_is_valid() reads the length of each advertising data field and then checks the type byte. However, it performs the type check before ensuring the field fits within the buffer, which can cause it to read one byte beyond the buffer if the length byte is the last byte.

This out-of-bounds read can lead to memory safety issues, as detected by KASAN (Kernel Address Sanitizer), which reported a vmalloc-out-of-bounds error when a malformed MGMT_OP_ADD_ADVERTISING request triggered this code path.

The fix involved moving the length check before inspecting the type byte to ensure that each element is fully contained within the buffer before accessing its type.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the Linux kernel Bluetooth management code. Such memory safety issues can potentially be exploited to cause system crashes, denial of service, or possibly escalate privileges depending on the context and further exploitation.

Since it involves kernel memory, exploitation could compromise system stability or security, affecting devices running vulnerable Linux kernels with Bluetooth enabled.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a buffer over-read in the Bluetooth MGMT advertising data parser in the Linux kernel. Detection would involve monitoring for kernel messages or logs indicating KASAN (Kernel Address Sanitizer) reports related to vmalloc-out-of-bounds reads in the function tlv_data_is_valid().

You can check your system logs (e.g., using dmesg or journalctl) for messages similar to:

• dmesg | grep -i 'KASAN: vmalloc-out-of-bounds'
• journalctl -k | grep -i 'tlv_data_is_valid'

Additionally, monitoring Bluetooth management commands or malformed MGMT_OP_ADD_ADVERTISING requests could help detect attempts to exploit this issue, but no specific commands for this are provided.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by moving the element-length check before any type-octet inspection in the Bluetooth MGMT advertising data parser. Immediate mitigation steps include:

• Update your Linux kernel to a version that includes the fix for this vulnerability.
• If updating immediately is not possible, consider disabling Bluetooth management advertising features temporarily to reduce exposure.
• Monitor system logs for any suspicious KASAN reports or malformed Bluetooth management commands.

Useful 0 Not Useful 0