Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submit a reserved OCF that aliases an allowlisted command modulo 128. A conforming controller should reject reserved opcodes. Nevertheless, the security decision must apply to the opcode that will actually be sent, especially since controller-specific behavior is outside the host stack's control. Reject OCF values that cannot be represented by the security filter instead of aliasing them onto an unrelated command.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 70b0a27bdde0cb524349c8261202c7c9393cf5e9affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 598686f5d65b9af2223ed9d22fadba16e09f6ca8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c1fd465ea1c5aef459f9bc3ac602b5353e0f536faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 68f0bcc4e16e31ff8dbe6ca93116eb70d7b6ac44affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 320dedad15e8bbaecc8d2d7fd4189defb84caa85affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 173457fa3e99ef4188dd0fe63e4dee98d0e441a9affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 47d67ec424e63e61e9eb58633d43a9d58a1852b6affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e93fad891c72deb84cae49430163b384ebcc92b1affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/70b0a27bdde0cb524349c8261202c7c9393cf5e9 ↗
- https://git.kernel.org/stable/c/598686f5d65b9af2223ed9d22fadba16e09f6ca8 ↗
- https://git.kernel.org/stable/c/c1fd465ea1c5aef459f9bc3ac602b5353e0f536f ↗
- https://git.kernel.org/stable/c/68f0bcc4e16e31ff8dbe6ca93116eb70d7b6ac44 ↗
- https://git.kernel.org/stable/c/320dedad15e8bbaecc8d2d7fd4189defb84caa85 ↗
- https://git.kernel.org/stable/c/173457fa3e99ef4188dd0fe63e4dee98d0e441a9 ↗
- https://git.kernel.org/stable/c/47d67ec424e63e61e9eb58633d43a9d58a1852b6 ↗
- https://git.kernel.org/stable/c/e93fad891c72deb84cae49430163b384ebcc92b1 ↗