Summary

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.

Description

Most functions that make use of bt_hci_cmd_send_sync to receive the response to a HCI command do not verify the response length is sufficient before casting to the expected response struct. This leads to buffer overreads in many places including e.g. common_init and le_init .

See for example hci_le_read_max_data_len:

struct bt_hci_rp_le_read_max_data_len *rp;
struct net_buf *rsp;

bt_hci_cmd_send_sync(BT_HCI_OP_LE_READ_MAX_DATA_LEN, NULL, &rsp);

rp = (void *)rsp->data;
*tx_octets = sys_le16_to_cpu(rp->max_tx_octets);
*tx_time = sys_le16_to_cpu(rp->max_tx_time);

BT_HCI_OP_LE_READ_MAX_DATA_LEN defines the command opcode, rsp is the buffer containing the response data. No size check is done before the cast into bt_hci_rp_le_read_max_data_len.

Buffer size checks are done until the bt_hci_evt_cmd_complete header. This includes the required header size in coming events in hci_event_prio:

BT_ASSERT(buf->len >= sizeof(*hdr));

The check for the bt_hci_evt_cmd_complete header is done by handle_event_common:

if (buf->len < handler->min_len) {
    BT_ERR("Too small (%u bytes) event 0x%02x", buf->len, event);
    return -EINVAL;
}

But this does not contain a check for the expected length of the data:

// #define EVENT_HANDLER(_evt, _handler, _min_len)
EVENT_HANDLER(BT_HCI_EVT_CMD_COMPLETE, hci_cmd_complete, sizeof(struct bt_hci_evt_cmd_complete)),

struct bt_hci_evt_cmd_complete { uint8_t  ncmd; uint16_t opcode; }

Impact

• Potentially allows an attacker leak information.
• Potentially cause a Denial of Service.

Proposed Fix

• Add a mandatory min_size argument to bt_hci_cmd_send_sync similar to the handler->min_len check in handle_event_common.
• Or: Verify the buffer length on each call side of bt_hci_cmd_send_sync before casting.

Patches

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2023-01-03