DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 301F92145D
Date:   Thu, 18 Oct 2018 19:11:49 +0300
From:   Johan Hedberg <johan.hedberg@gmail.com>
To:     Matias Karhumaa <matias.karhumaa@gmail.com>
Cc:     linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH 00/12] btmon: multiple memory management vulnerabilities
 fixed
Message-ID: <20181018161149.GA11513@x1c.home>
Mail-Followup-To: Matias Karhumaa <matias.karhumaa@gmail.com>,
        linux-bluetooth@vger.kernel.org
References: <20181016201908.GA84982@Matias-MacBook-Air.local>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20181016201908.GA84982@Matias-MacBook-Air.local>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Matias,

On Tue, Oct 16, 2018, Matias Karhumaa wrote:
> Multiple different memory management vulnerabilities were discovered in
> btmon while fuzzing it with American Fuzzy Lop. Purpose of this fuzzing
> effort was to find some bugs in btmon, analyse and fix them but also try
> to exploit them. Also goal was to prove that fuzzing is low effort way
> to find bugs that could end up being severe ones.
> 
> Most common weakness appeared to be buffer over-read which was usually
> caused by missing boundary checks before accessing array. Integer
> underflows were also quite common. Most interesting bug was simple
> buffer overflow that was actually discovered already couple years ago
> by op7ic: https://www.spinics.net/lists/linux-bluetooth/msg68898.html
> but it was still not fixed. This particular vulnerability ended up being
> quite easily exploitable if certain mitigation technics were disabled.
> 
> Matias Karhumaa (12):
>   btmon: fix segfault caused by buffer over-read
>   btmon: fix segfault caused by buffer over-read
>   btmon: fix segfault caused by buffer over-read
>   btmon: Fix crash caused by integer underflow
>   btmon: fix stack buffer overflow
>   btmon: fix multiple segfaults
>   btmon: fix segfault caused by integer underflow
>   btmon: fix segfault caused by integer undeflow
>   btmon: fix segfault caused by buffer over-read
>   btmon: fix segfault caused by buffer overflow
>   btmon: fix segfault caused by integer underflow
>   btmon: fix segfault caused by buffer over-read
> 
>  monitor/packet.c     | 56 +++++++++++++++++++++++++++++++++++++++++---
>  monitor/sdp.c        | 21 ++++++++++++++++-
>  src/shared/btsnoop.c |  5 ++++
>  3 files changed, 78 insertions(+), 4 deletions(-)

All patches in this set have been applied. Thanks!

Johan