[PATCH] bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

[PATCH] bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

[Bastien Nocera]

A stack buffer overflow (CWE-121) in bap_sink_match_allocation() in
src/shared/bap.c allows an attacker within BLE range to write ~195
attacker-controlled bytes past a 4-byte stack buffer in bluetoothd
with no pairing, no connection, and no user interaction. The BAP
profile auto-syncs to any device advertising the BCAAS UUID.

bap_sink_match_allocation() copies the value of an
Audio_Channel_Allocation LTV (type 0x03) into a 4-byte uint32_t stack
local using the LTV's attacker-controlled length byte as the memcpy
size, with no upper bound check:
	// src/shared/bap.c:7767
	memcpy(&location32, v, l);  // l attacker-controlled, no upper bound

A second identical instance exists in bap_sink_get_allocation() at line 2558.

Per Bluetooth Assigned Numbers, Audio_Channel_Allocation is a fixed 4-octet
bitfield; any other length is malformed.

https://github.com/bluez/bluez/security/advisories/GHSA-9683-2chf-hfw9

Co-Authored-by: @thaidn and @bronson-calif of Calif.io in collaboration with
  Claude and Anthropic Research.
Reported-by: @thaidn and @bronson-calif of Calif.io in collaboration with
  Claude and Anthropic Research.
---
 src/shared/bap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 1660b8b2c1cf..da3e265e2077 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2555,7 +2555,7 @@ static void bap_sink_get_allocation(size_t i, uint8_t l, uint8_t t,
 {
 	uint32_t location32;
 
-	if (!v)
+	if (!v || l != sizeof(location32))
 		return;
 
 	memcpy(&location32, v, l);
@@ -7764,7 +7764,7 @@ static void bap_sink_match_allocation(size_t i, uint8_t l, uint8_t t,
 	struct bt_ltv_match *data = user_data;
 	uint32_t location32;
 
-	if (!v)
+	if (!v || l != sizeof(location32))
 		return;
 
 	memcpy(&location32, v, l);
-- 
2.55.0

RE: bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3574 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1152690

---Test result---

Test Summary:
CheckPatch                    FAIL      0.49 seconds
GitLint                       FAIL      0.34 seconds
BuildEll                      PASS      20.40 seconds
BluezMake                     PASS      555.72 seconds
MakeCheck                     PASS      12.86 seconds
MakeDistcheck                 PASS      156.34 seconds
CheckValgrind                 PASS      204.05 seconds
CheckSmatch                   WARNING   299.86 seconds
bluezmakeextell               PASS      97.06 seconds
IncrementalBuild              PASS      569.54 seconds
ScanBuild                     PASS      898.11 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser
WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#63: 
A second identical instance exists in bap_sink_get_allocation() at line 2558.

WARNING:BAD_SIGN_OFF: Non-standard signature: Co-Authored-by:
#70: 
Co-Authored-by: @thaidn and @bronson-calif of Calif.io in collaboration with

WARNING:BAD_SIGN_OFF: 'Co-authored-by:' is the preferred signature form
#70: 
Co-Authored-by: @thaidn and @bronson-calif of Calif.io in collaboration with

ERROR:BAD_SIGN_OFF: Unrecognized email address: '@thaidn and @bronson-calif of Calif.io in collaboration with'
#70: 
Co-Authored-by: @thaidn and @bronson-calif of Calif.io in collaboration with

ERROR:BAD_SIGN_OFF: Unrecognized email address: '@thaidn and @bronson-calif of Calif.io in collaboration with'
#72: 
Reported-by: @thaidn and @bronson-calif of Calif.io in collaboration with

/github/workspace/src/patch/14771430.patch total: 2 errors, 3 warnings, 16 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14771430.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

13: B3 Line contains hard tab characters (\t): "	// src/shared/bap.c:7767"
14: B3 Line contains hard tab characters (\t): "	memcpy(&location32, v, l);  // l attacker-controlled, no upper bound"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures


https://github.com/bluez/bluez/pull/2443

---
Regards,
Linux Bluetooth

Re: [PATCH] bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 27 Aug 2026 16:58:00 +0200 you wrote:
> A stack buffer overflow (CWE-121) in bap_sink_match_allocation() in
> src/shared/bap.c allows an attacker within BLE range to write ~195
> attacker-controlled bytes past a 4-byte stack buffer in bluetoothd
> with no pairing, no connection, and no user interaction. The BAP
> profile auto-syncs to any device advertising the BCAAS UUID.
> 
> bap_sink_match_allocation() copies the value of an
> Audio_Channel_Allocation LTV (type 0x03) into a 4-byte uint32_t stack
> local using the LTV's attacker-controlled length byte as the memcpy
> size, with no upper bound check:
> 	// src/shared/bap.c:7767
> 	memcpy(&location32, v, l);  // l attacker-controlled, no upper bound
> 
> [...]

Here is the summary with links:
  - bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=627f9fae7895

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html