Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Alain Michaud <alainm@chromium.org>
To:     linux-bluetooth@vger.kernel.org
Cc:     Alain Michaud <alainm@chromium.org>
Subject: [BlueZ PATCH 0/2] HID and HOGP connections from non-bonded devices.
Date:   Tue, 10 Mar 2020 02:35:14 +0000
Message-Id: <20200310023516.209146-1-alainm@chromium.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

It was discovered that BlueZ's HID and HOGP profiles implementations
don't specifically require bonding between the device and the host.

This creates an opportunity for an malicious device to connect to a
target host to either impersonate an existing HID device without
security or to cause an SDP or GATT service discovery to take place
which would allow HID reports to be injected to the input subsystem from
a non-bonded source.

This patch series addresses the issue by ensuring that only connections
from devices that are bonded are accepted by the HID and HOGP profile
implementation.

More information about the vulnerability is available here:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.html

Alain Michaud (2):
  HOGP must only accept data from bonded devices.
  HID accepts bonded device connections only.

 profiles/input/device.c   | 23 ++++++++++++++++++++++-
 profiles/input/device.h   |  1 +
 profiles/input/hog.c      |  4 ++++
 profiles/input/input.conf |  8 ++++++++
 profiles/input/manager.c  | 13 ++++++++++++-
 5 files changed, 47 insertions(+), 2 deletions(-)

-- 
2.25.1.481.gfbce0eb801-goog