linux-kernel - [BUG 4 / 6] L2cap: Spec violations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221118040313.630791-1-git@sung-woo.kim>
Date:   Thu, 17 Nov 2022 23:03:13 -0500
From:   Sungwoo Kim <happiness.sung.woo@...il.com>
To:     iam@...g-woo.kim
Cc:     davem@...emloft.net, edumazet@...gle.com, johan.hedberg@...il.com,
        kuba@...nel.org, linux-bluetooth@...r.kernel.org,
        linux-kernel@...r.kernel.org, luiz.dentz@...il.com,
        marcel@...tmann.org, netdev@...r.kernel.org, pabeni@...hat.com
Subject: [BUG 4 / 6] L2cap: Spec violations

4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.240003
= Note: Bluetooth subsystem version 2.22                               0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 12.003575
        invalid packet size (12 != 1033)
        08 00 01 00 02 01 04 00 01 10 ff ff              ............    
@ MGMT Event: Device Connected (0x000b) plen 13       {0x0001} [hci0] 12.024700
        BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Flags: 0x00000000
        Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13       {0x0002} [hci0] 12.024700
        BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Flags: 0x00000000
        Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char..   12.049885
> ACL Data RX: Handle 200 flags 0x00 dlen 1804             #33 [hci0] 12.003613
        invalid packet size (15 != 1804)
        0b 00 01 00 04 01 07 00 40 00 00 00 05 01 00     ........@...... 
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 12.004416
        invalid packet size (16 != 2061)
        0c 00 01 00 05 01 08 00 40 00 00 00 01 00 ff 80  ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 12.004968
        invalid packet size (16 != 2061)
        0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00  ................