DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EBB5920869
Date:   Tue, 16 Oct 2018 23:19:08 +0300
From:   Matias Karhumaa <matias.karhumaa@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH 00/12] btmon: multiple memory management vulnerabilities fixed
Message-ID: <20181016201908.GA84982@Matias-MacBook-Air.local>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.6.1 (2016-04-27)
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Multiple different memory management vulnerabilities were discovered in
btmon while fuzzing it with American Fuzzy Lop. Purpose of this fuzzing
effort was to find some bugs in btmon, analyse and fix them but also try
to exploit them. Also goal was to prove that fuzzing is low effort way
to find bugs that could end up being severe ones.

Most common weakness appeared to be buffer over-read which was usually
caused by missing boundary checks before accessing array. Integer
underflows were also quite common. Most interesting bug was simple
buffer overflow that was actually discovered already couple years ago
by op7ic: https://www.spinics.net/lists/linux-bluetooth/msg68898.html
but it was still not fixed. This particular vulnerability ended up being
quite easily exploitable if certain mitigation technics were disabled.

Matias Karhumaa (12):
  btmon: fix segfault caused by buffer over-read
  btmon: fix segfault caused by buffer over-read
  btmon: fix segfault caused by buffer over-read
  btmon: Fix crash caused by integer underflow
  btmon: fix stack buffer overflow
  btmon: fix multiple segfaults
  btmon: fix segfault caused by integer underflow
  btmon: fix segfault caused by integer undeflow
  btmon: fix segfault caused by buffer over-read
  btmon: fix segfault caused by buffer overflow
  btmon: fix segfault caused by integer underflow
  btmon: fix segfault caused by buffer over-read

 monitor/packet.c     | 56 +++++++++++++++++++++++++++++++++++++++++---
 monitor/sdp.c        | 21 ++++++++++++++++-
 src/shared/btsnoop.c |  5 ++++
 3 files changed, 78 insertions(+), 4 deletions(-)

-- 
2.17.1