[lvc-project] Patch "Bluetooth: Add more enc key size check" has been added to the 5.10-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Wed Dec 3 16:31:17 MSK 2025
This is a note to let you know that I've just added the patch titled
Bluetooth: Add more enc key size check
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bluetooth-add-more-enc-key-size-check.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From stable+bounces-197599-greg=kroah.com at vger.kernel.org Fri Nov 28 15:45:35 2025
From: Nazar Kalashnikov <sivartiwe at gmail.com>
Date: Fri, 28 Nov 2025 17:45:34 +0300
Subject: Bluetooth: Add more enc key size check
To: stable at vger.kernel.org, Greg Kroah-Hartman <gregkh at linuxfoundation.org>
Cc: Nazar Kalashnikov <sivartiwe at gmail.com>, Marcel Holtmann <marcel at holtmann.org>, Johan Hedberg <johan.hedberg at gmail.com>, "David S. Miller" <davem at davemloft.net>, Jakub Kicinski <kuba at kernel.org>, linux-bluetooth at vger.kernel.org, netdev at vger.kernel.org, linux-kernel at vger.kernel.org, lvc-project at linuxtesting.org, Alex Lu <alex_lu at realsil.com.cn>, Max Chou <max.chou at realtek.com>, Luiz Augusto von Dentz <luiz.von.dentz at intel.com>
Message-ID: <20251128144535.55357-1-sivartiwe at gmail.com>
From: Alex Lu <alex_lu at realsil.com.cn>
[ Upstream commit 04a342cc49a8522e99c9b3346371c329d841dcd2 ]
When we are slave role and receives l2cap conn req when encryption has
started, we should check the enc key size to avoid KNOB attack or BLUFFS
attack.
>From SIG recommendation, implementations are advised to reject
service-level connections on an encrypted baseband link with key
strengths below 7 octets.
A simple and clear way to achieve this is to place the enc key size
check in hci_cc_read_enc_key_size()
The btmon log below shows the case that lacks enc key size check.
> HCI Event: Connect Request (0x04) plen 10
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Class: 0x480104
Major class: Computer (desktop, notebook, PDA, organizers)
Minor class: Desktop workstation
Capturing (Scanner, Microphone)
Telephony (Cordless telephony, Modem, Headset)
Link type: ACL (0x01)
< HCI Command: Accept Connection Request (0x01|0x0009) plen 7
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Role: Peripheral (0x01)
> HCI Event: Command Status (0x0f) plen 4
Accept Connection Request (0x01|0x0009) ncmd 2
Status: Success (0x00)
> HCI Event: Connect Complete (0x03) plen 11
Status: Success (0x00)
Handle: 1
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Link type: ACL (0x01)
Encryption: Disabled (0x00)
...
> HCI Event: Encryption Change (0x08) plen 4
Status: Success (0x00)
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Encryption: Enabled with E0 (0x01)
< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
> HCI Event: Command Complete (0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 2
Status: Success (0x00)
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Key size: 6
// We should check the enc key size
...
> ACL Data RX: Handle 1 flags 0x02 dlen 12
L2CAP: Connection Request (0x02) ident 3 len 4
PSM: 25 (0x0019)
Source CID: 64
< ACL Data TX: Handle 1 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 3 len 8
Destination CID: 64
Source CID: 64
Result: Connection pending (0x0001)
Status: Authorization pending (0x0002)
> HCI Event: Number of Completed Packets (0x13) plen 5
Num handles: 1
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Count: 1
#35: len 16 (25 Kb/s)
Latency: 5 msec (2-7 msec ~4 msec)
< ACL Data TX: Handle 1 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 3 len 8
Destination CID: 64
Source CID: 64
Result: Connection successful (0x0000)
Status: No further information available (0x0000)
Cc: stable at vger.kernel.org
Signed-off-by: Alex Lu <alex_lu at realsil.com.cn>
Signed-off-by: Max Chou <max.chou at realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz at intel.com>
[ Nazar Kalashnikov: change status to
rp_status due to function parameter conflict ]
Signed-off-by: Nazar Kalashnikov <sivartiwe at gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
Backport fix for CVE-2023-24023
net/bluetooth/hci_event.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3043,6 +3043,7 @@ static void read_enc_key_size_complete(s
const struct hci_rp_read_enc_key_size *rp;
struct hci_conn *conn;
u16 handle;
+ u8 rp_status;
BT_DBG("%s status 0x%02x", hdev->name, status);
@@ -3052,6 +3053,7 @@ static void read_enc_key_size_complete(s
}
rp = (void *)skb->data;
+ rp_status = rp->status;
handle = le16_to_cpu(rp->handle);
hci_dev_lock(hdev);
@@ -3064,15 +3066,30 @@ static void read_enc_key_size_complete(s
* secure approach is to then assume the key size is 0 to force a
* disconnection.
*/
- if (rp->status) {
+ if (rp_status) {
bt_dev_err(hdev, "failed to read key size for handle %u",
handle);
conn->enc_key_size = 0;
} else {
conn->enc_key_size = rp->key_size;
+ rp_status = 0;
+
+ if (conn->enc_key_size < hdev->min_enc_key_size) {
+ /* As slave role, the conn->state has been set to
+ * BT_CONNECTED and l2cap conn req might not be received
+ * yet, at this moment the l2cap layer almost does
+ * nothing with the non-zero status.
+ * So we also clear encrypt related bits, and then the
+ * handler of l2cap conn req will get the right secure
+ * state at a later time.
+ */
+ rp_status = HCI_ERROR_AUTH_FAILURE;
+ clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
+ clear_bit(HCI_CONN_AES_CCM, &conn->flags);
+ }
}
- hci_encrypt_cfm(conn, 0);
+ hci_encrypt_cfm(conn, rp_status);
unlock:
hci_dev_unlock(hdev);
Patches currently in stable-queue which might be from sivartiwe at gmail.com are
queue-5.10/bluetooth-add-more-enc-key-size-check.patch
queue-5.10/netfilter-nf_set_pipapo-fix-initial-map-fill.patch
queue-5.10/scsi-pm80xx-set-phy-enable_completion-only-when-we.patch
queue-5.10/fs-writeback-fix-use-after-free-in-__mark_inode_dirty.patch
More information about the lvc-project
mailing list