linux-kernel - Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <2E345B0D-5412-4DC1-9E22-452939DD7D2B@holtmann.org>
Date:   Sun, 20 Sep 2020 08:09:34 +0200
From:   Marcel Holtmann <marcel@...tmann.org>
To:     Alex Lu <alex_lu@...lsil.com.cn>
Cc:     Johan Hedberg <johan.hedberg@...il.com>,
        linux-bluetooth <linux-bluetooth@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        Max Chou <max.chou@...ltek.com>
Subject: Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

Hi Alex,

> When someone attacks the service provider, it creates connection,
> authenticates. Then it requests key size of one byte and it identifies
> the key with brute force methods.
> 
> After l2cap info req/resp exchange is complete. the attacker sends l2cap
> connect with specific PSM.
> 
> In above procedure, there is no chance for the service provider to check
> the encryption key size before l2cap_connect(). Because the state of
> l2cap chan in conn->chan_l is BT_LISTEN, there is no l2cap chan with the
> state of BT_CONNECT or BT_CONNECT2.
> 
> So service provider should check the encryption key size in
> l2cap_connect()
> 
> Signed-off-by: Alex Lu <alex_lu@...lsil.com.cn>
> ---
> net/bluetooth/l2cap_core.c | 7 +++++++
> 1 file changed, 7 insertions(+)
> 
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index ade83e224567..63df961d402d 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4150,6 +4150,13 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
> 
> 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
> 		if (l2cap_chan_check_security(chan, false)) {
> +			if (!l2cap_check_enc_key_size(conn->hcon)) {
> +				l2cap_state_change(chan, BT_DISCONN);
> +				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
> +				result = L2CAP_CR_SEC_BLOCK;
> +				status = L2CAP_CS_NO_INFO;
> +				goto response;
> +			}
> 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
> 				l2cap_state_change(chan, BT_CONNECT2);
> 				result = L2CAP_CR_PEND;

I am not following what you are trying to fix here. Can you show this with a btmon trace from an attacking device?

Regards

Marcel