Commit 814dc650 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Yongqiang Liu
Browse files

Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM

mainline inclusion
from mainline-v6.1-rc4
commit 711f8c3f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ZNPH


CVE: CVE-2022-42896

--------------------------------

The Bluetooth spec states that the valid range for SPSM is from
0x0001-0x00ff so it is invalid to accept values outside of this range:

  BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
  page 1059:
  Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges

CVE: CVE-2022-42896
CC: stable@vger.kernel.org
Reported-by: default avatarTamás Koczka <poprdi@google.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reviewed-by: default avatarTedd Ho-Jeong An <tedd.an@intel.com>
Conflicts:
	net/bluetooth/l2cap_core.c
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu Jian <liujian56@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 21714ac1
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment