Summary
The function llcp_pdu_decode_conn_update_ind in subsys/bluetooth/controller/ll_sw/ull_llcp_pdu.c does not validate the content before using it. An malicious BLE device can crash BLE peripheral's BLE controller by sending malformed LL_CONNECTION_UPDATE_IND packet.
Description
Assume that the controller of peripheral (victim) is currently executing the Central-initiated Connection Parameters
Request procedure.
If an attacker sends an malicious LL_CONNECTION_PARAM_IND packet with Interval set to zero to peripheral, then peripheral will process it according to the call sequence below.
lp_cu_st_wait_rx_conn_update_ind or rp_cu_st_wait_rx_conn_update_ind . Both of these two function will execute llcp_pdu_decode_conn_update_ind to setup ctx->data.cu.interval_max to zerolp_cu_check_instant or rp_cu_check_instant . Both of these two function will execute cu_update_conn_parametersull_conn_update_parameters will be executed in cu_update_conn_parameters , and the argument interval of this function will be set to ctx->data.cu.interval_max which is zero. Consequently, when executing latency_upd = conn_interval_old / interval; , a division by zero will be triggered.
crash backtrace screenshot
gdb crash screenshot
Patches
main: #72608
For more information
If you have any questions or comments about this advisory:
embargo: 2024-08-07
Credits
Reported by Wei Che Kao (Xiaobye), graduate student from National Yang Ming Chiao Tung University, Dept. of CS,
Security and Systems Lab.
xiaobye-ctf Reporter
Summary
The function llcp_pdu_decode_conn_update_ind in subsys/bluetooth/controller/ll_sw/ull_llcp_pdu.c does not validate the content before using it. An malicious BLE device can crash BLE peripheral's BLE controller by sending malformed
LL_CONNECTION_UPDATE_INDpacket.Description
Assume that the controller of peripheral (victim) is currently executing the Central-initiated Connection Parameters
Request procedure.
If an attacker sends an malicious
LL_CONNECTION_PARAM_INDpacket with Interval set to zero to peripheral, then peripheral will process it according to the call sequence below.lp_cu_st_wait_rx_conn_update_indorrp_cu_st_wait_rx_conn_update_ind. Both of these two function will executellcp_pdu_decode_conn_update_indto setupctx->data.cu.interval_maxto zerolp_cu_check_instant or rp_cu_check_instant. Both of these two function will executecu_update_conn_parametersull_conn_update_parameterswill be executed incu_update_conn_parameters, and the argument interval of this function will be set toctx->data.cu.interval_maxwhich is zero. Consequently, when executinglatency_upd = conn_interval_old / interval;, a division by zero will be triggered.crash backtrace screenshot
gdb crash screenshot
Patches
main: #72608
For more information
If you have any questions or comments about this advisory:
embargo: 2024-08-07
Credits
Reported by Wei Che Kao (Xiaobye), graduate student from National Yang Ming Chiao Tung University, Dept. of CS,
Security and Systems Lab.