bluez5_utils: add upstream security fix for CVE-2017-1000250
PATCH 1/1 bluez5_utils: add upstream security fix for CVE-2017-1000250
Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
--- ...-of-bounds-heap-read-in-service_search_at.patch | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 package/bluez5_utils/0002-sdp-Fix-Out-of-bounds-heap-read-in-service_search_at.patch
package/bluez5_utils/0002-sdp-Fix-Out-of-bounds-heap-read-in-service_search_at.patch new file +29 -0
@@ -0,0 +1,29 @@ +From 9e009647b14e810e06626dde7f1bb9ea3c375d09 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz <[email protected]> +Date: Wed, 13 Sep 2017 10:01:40 +0300 +Subject: [PATCH] sdp: Fix Out-of-bounds heap read in service_search_attr_req + function + +Check if there is enough data to continue otherwise return an error. + +Signed-off-by: Peter Korsgaard <[email protected]> +--- + src/sdpd-request.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/sdpd-request.c b/src/sdpd-request.c +index 1eefdce1a..318d04467 100644 +--- a/src/sdpd-request.c ++++ b/src/sdpd-request.c +@@ -917,7 +917,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf) + } else { + /* continuation State exists -> get from cache */ + sdp_buf_t *pCache = sdp_get_cached_rsp(cstate); +- if (pCache) { ++ if (pCache && cstate->cStateValue.maxBytesSent < pCache->data_size) { + uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent); + pResponse = pCache->data; + memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent); +-- +2.11.0 +
Signature · 1 line
2.11.0
PATCH 1/1 bluez5_utils: add upstream security fix for CVE-2017-1000250
Am Wed, 13 Sep 2017 14:19:55 +0200 schrieb Peter Korsgaard:
Quoted 5 lines
Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
Hi,
this patch was is included in upstream release 5.47 and can be marked as superseded by this patch: http://patchwork.ozlabs.org/patch/814482/
Regards, Bernd
PATCH 1/1 bluez5_utils: add upstream security fix for CVE-2017-1000250
Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Bernd" == Bernd Kuhls <[email protected]> writes:
Am Wed, 13 Sep 2017 14:19:55 +0200 schrieb Peter Korsgaard:
Quoted 5 lines
Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
Quoted 4 lines
Hi,
this patch was is included in upstream release 5.47 and can be marked as superseded by this patch: http://patchwork.ozlabs.org/patch/814482/
Yes, now that 5.47 is out, bumping the version makes more sense.
Signature · 1 line
Bye, Peter Korsgaard
PATCH 1/1 bluez5_utils: add upstream security fix for CVE-2017-1000250
In reply to Peter KorsgaardQuoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
Signed-off-by Peter Korsgaard <[email protected]>
Committed to 2017.02.x, thanks (seems safer than bumping to 5.47).
Signature · 1 line
Bye, Peter Korsgaard