Summary

An out-of-bounds write in get_att_search_list in subsys/bluetooth/host/sdp.c can lead to a stack overflow.

Details

There is no limit on the number of data_elem to be parsed, leading to an out-of-bounds write in subsequent accesses of filter.

	...
	while (size) {
		res = parse_data_elem(buf, &data_elem);
		if (res) {
			return res;
		}

		if ((data_elem.type & BT_SDP_TYPE_DESC_MASK) != BT_SDP_UINT8) {
			LOG_WRN("Invalid type %u in attribute ID list", data_elem.type);
			return BT_SDP_INVALID_SYNTAX;
		}

		if (buf->len < data_elem.data_size) {
			LOG_WRN("Malformed packet");
			return BT_SDP_INVALID_SYNTAX;
		}

		/* This is an attribute ID */
		if (data_elem.data_size == 2U) {

			/* Out-of-bounds write */
			filter[(*num_filters)++] = 0xffff0000 |
							net_buf_pull_be16(buf);
		}
	...

The get_att_search_list is called by either sdp_svc_att_req or sdp_svc_search_att_req. Both calls provide a filter with a maximum size of MAX_NUM_ATT_ID_FILTER.

...
static uint16_t sdp_svc_search_att_req(struct bt_sdp *sdp, struct net_buf *buf,
				    uint16_t tid)
{
	uint32_t filter[MAX_NUM_ATT_ID_FILTER];
	...

	res = get_att_search_list(buf, filter, &num_filters);

Thus, if the parsed data_elem exceeds MAX_NUM_ATT_ID_FILTER, it can leads to a stack overflow.

PoC

Since MAX_NUM_ATT_ID_FILTER is defined as 10, the number of data_elem should exceed 10 to cause a stack overflow.

To increment num_filter, the data_size of data_elem should be either 2 or 4. An example of a data_elem could be 08 ff ff.

Impact

Result of exploitation could lead to instability (i.e., crash) or denial of service attacks.

Patches

main: #75575

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2024-09-11