Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
346af67b8d116f01ef696fd47959a55deb2db8b6 to < 0f37d1e65c6d71ad94ccfb5c602163c525db789daffected346af67b8d116f01ef696fd47959a55deb2db8b6 to < 257cdb960d8ff6d60bb6461b03c814b6cf0c9e64affected346af67b8d116f01ef696fd47959a55deb2db8b6 to < c34577f517b556fb6ca173d45bf7e766ae2564ceaffected346af67b8d116f01ef696fd47959a55deb2db8b6 to < f71695e81f4cb428f3c7e2138eae88199005b52caffected346af67b8d116f01ef696fd47959a55deb2db8b6 to < 82f342b3b006ca1d65f4890c05f2ec32fcb808b6affected346af67b8d116f01ef696fd47959a55deb2db8b6 to < 50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257affected346af67b8d116f01ef696fd47959a55deb2db8b6 to < 40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009affected346af67b8d116f01ef696fd47959a55deb2db8b6 to < b8dbe9648d69059cfe3a28917bfbf7e61efd7f15affected
Linux Linux
Default version status: affected
3.4affected0 to < 3.4unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d ↗
- https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64 ↗
- https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce ↗
- https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c ↗
- https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6 ↗
- https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257 ↗
- https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009 ↗
- https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 ↗