CVE-2022-48947

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix u8 overflow

By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases

multiple times and eventually it will wrap around the maximum number

(i.e., 255).

This patch prevents this by adding a boundary check with

L2CAP_MAX_CONF_RSP

Btmon log:

Bluetooth monitor ver 5.64

= Note: Linux version 6.1.0-rc2 (x86_64) 0.264594

= Note: Bluetooth subsystem version 2.22 0.264636

@ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191

= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604

@ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741

= Open Index: 00:00:00:00:00:00 [hci0] 13.900426

(...)

> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106

invalid packet size (12 != 1033)

08 00 01 00 02

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References