In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAPCONFREQ packets, chan->numconfrsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAPMAXCONF_RSP
Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...)
ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@...
{ "vanir_signatures": [ { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d5867819ab7c744852b45509e8469839c07e0e", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-0b259d47", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a78143961a197de8502f4f29c453b913dc3c29", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-2e76b457", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5550bbf709c323194881737fd290c4bada9e6ead", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-3d07b9ae", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49d5867819ab7c744852b45509e8469839c07e0e", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-410b6ab5", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fdc79b571434af7bc742da40a3405f038b637a7", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-4a3ffd1a", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95f1847a361c7b4bf7d74c06ecb6968455082c1a", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-5b91b074", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19a78143961a197de8502f4f29c453b913dc3c29", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-6e966d95", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd70260ef56e0aee8a4fc6cd214a419900b0765", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-77b050b4", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad528fde0702903208d0a79d88d5a42ae3fc235b", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-7eaa9939", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3fe6817156a2ad4b06f01afab04638a34d7c9a6", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-a1a3187c", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95f1847a361c7b4bf7d74c06ecb6968455082c1a", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-ad953e0c", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad528fde0702903208d0a79d88d5a42ae3fc235b", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-b73d7d8a", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3fe6817156a2ad4b06f01afab04638a34d7c9a6", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-ca80c85d", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5550bbf709c323194881737fd290c4bada9e6ead", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-e4a4792f", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fdc79b571434af7bc742da40a3405f038b637a7", "digest": { "threshold": 0.9, "line_hashes": [ "89925628004671564044139902845848256787", "217317916445615497606558359681652546329", "273098405937901538836110891096418679147", "275952102670935021307023424553425789836" ] }, "id": "CVE-2022-48947-e5e2a66a", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "l2cap_config_req", "file": "net/bluetooth/l2cap_core.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bcd70260ef56e0aee8a4fc6cd214a419900b0765", "digest": { "length": 2251.0, "function_hash": "82504778914016723287226911818757240808" }, "id": "CVE-2022-48947-f6611b93", "deprecated": false, "signature_type": "Function", "signature_version": "v1" } ] }