Andrew Lukoshko
b9d46fff46
Add the RHEL 211.17.1..211.18.1 backports (1162-1244) from centos-stream-10 and upstream, on top of 211.16.1. Includes the lpfc 14.4.0.x revert batch and the RHEL-only lpfc_nlp_get UAF guard. Bump to 211.18.1.
49 lines
1.6 KiB
Diff
49 lines
1.6 KiB
Diff
From cd80e4a498a4387b0d597b2edd74c834ae730c5f Mon Sep 17 00:00:00 2001
|
|
From: David Marlin <dmarlin@redhat.com>
|
|
Date: Thu, 7 May 2026 18:00:59 -0500
|
|
Subject: [PATCH] Bluetooth: MGMT: validate LTK enc_size on load
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-172460
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-172580
|
|
CVE: CVE-2026-43020
|
|
|
|
commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15
|
|
Author: Keenan Dong <keenanat2000@gmail.com>
|
|
Date: Sat Mar 28 16:46:47 2026 +0800
|
|
|
|
Bluetooth: MGMT: validate LTK enc_size on load
|
|
|
|
Load Long Term Keys stores the user-provided enc_size and later uses
|
|
it to size fixed-size stack operations when replying to LE LTK
|
|
requests. An enc_size larger than the 16-byte key buffer can therefore
|
|
overflow the reply stack buffer.
|
|
|
|
Reject oversized enc_size values while validating the management LTK
|
|
record so invalid keys never reach the stored key state.
|
|
|
|
Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's")
|
|
Reported-by: Keenan Dong <keenanat2000@gmail.com>
|
|
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
|
|
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
|
|
|
Signed-off-by: David Marlin <dmarlin@redhat.com>
|
|
|
|
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
|
|
index 9bf95af598a0..66e58fc556a5 100644
|
|
--- a/net/bluetooth/mgmt.c
|
|
+++ b/net/bluetooth/mgmt.c
|
|
@@ -7248,6 +7248,9 @@ static bool ltk_is_valid(struct mgmt_ltk_info *key)
|
|
if (key->initiator != 0x00 && key->initiator != 0x01)
|
|
return false;
|
|
|
|
+ if (key->enc_size > sizeof(key->val))
|
|
+ return false;
|
|
+
|
|
switch (key->addr.type) {
|
|
case BDADDR_LE_PUBLIC:
|
|
return true;
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|