linux-kernel - [BUG 2 / 6] L2cap: Spec violations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221118040241.630093-1-git@sung-woo.kim>
Date:   Thu, 17 Nov 2022 23:02:41 -0500
From:   Sungwoo Kim <happiness.sung.woo@...il.com>
To:     iam@...g-woo.kim
Cc:     davem@...emloft.net, edumazet@...gle.com, johan.hedberg@...il.com,
        kuba@...nel.org, linux-bluetooth@...r.kernel.org,
        linux-kernel@...r.kernel.org, luiz.dentz@...il.com,
        marcel@...tmann.org, netdev@...r.kernel.org, pabeni@...hat.com
Subject: [BUG 2 / 6] L2cap: Spec violations

2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.240003
= Note: Bluetooth subsystem version 2.22                               0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 23.498353
        invalid packet size (12 != 1033)
        08 00 01 00 02 01 04 00 01 10 ff ff              ............    
@ MGMT Event: Device Connected (0x000b) plen 13       {0x0001} [hci0] 23.498635
        BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Flags: 0x00000000
        Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13       {0x0002} [hci0] 23.498635
        BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Flags: 0x00000000
        Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char..   23.555719
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #33 [hci0] 23.527295
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 90 00 07 00  ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547             #34 [hci0] 23.538671
        invalid packet size (14 != 1547)
        0a 00 01 00 05 01 06 00 40 00 00 00 00 00        ........@.....