[PATCH] monitor: validate Return Link Keys length before parsing (CVE-2026-105460)

[PATCH] monitor: validate Return Link Keys length before parsing (CVE-2026-105460)

[contact]

From: Capsize Security <contact@capsize.online>

Fixes public issue bluez/bluez#2687 (also filed as GitHub PR #2715 for
reference). return_link_keys_evt() loops over evt->num_keys entries of
22 bytes while the dispatcher only enforces plen >= 1; a crafted
btsnoop capture overflows the on-stack packet buffer (ASan-confirmed).
The patch rejects short payloads with the file's too-short-packet idiom.

Verified: pristine btmon + crafted capture -> ASan stack-buffer-overflow;
patched btmon -> clean reject, exit 0; boundary matrix + unit checks pass.

Assisted-by: Muse-Code:muse-spark
---

[PATCH 1/1] monitor: validate Return Link Keys length before parsing

[contact]

From: Capsize Security <contact@capsize.online>

return_link_keys_evt() loops i < evt->num_keys dereferencing
keys + i*22 while the dispatcher only enforces plen >= 1.  A crafted
btsnoop capture (evt 0x15, plen=3, num_keys=85) overflows the on-stack
packet buffer (ASan stack-buffer-overflow in print_hexdump via
print_link_key).

Reject payloads shorter than 1 + num_keys*22 bytes with the file's
existing too-short-packet idiom.  No integer-overflow hazard: uint8
promotes to int, max 1+255*22=5611.

Verified: pristine HEAD btmon + crafted capture -> ASan
stack-buffer-overflow; patched btmon -> 'too short packet', exit 0,
ASan-clean.  Boundary matrix (valid 1-key, zero keys, exact-fit 2-key,
short-by-one, num_keys=255) all exit 0 ASan-clean.  make check passes
on the scratch build.

Fixes: 7d103ce15295 ("monitor: Add support for decoding the return link keys event")
Assisted-by: Muse-Code:muse-spark
---
 monitor/packet.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/monitor/packet.c b/monitor/packet.c
index a301e1ae7..e51cf7bb0 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -12224,6 +12224,11 @@ static void return_link_keys_evt(struct timeval *tv, uint16_t index,
 
 	print_field("Num keys: %d", evt->num_keys);
 
+	if (size < 1u + (unsigned int) evt->num_keys * 22u) {
+		print_text(COLOR_ERROR, "too short packet");
+		return;
+	}
+
 	for (i = 0; i < evt->num_keys; i++) {
 		print_bdaddr(evt->keys + (i * 22));
 		print_link_key(evt->keys + (i * 22) + 6);
-- 
2.47.3

RE: [1/1] monitor: validate Return Link Keys length before parsing

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1355 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1194173/

---Test result---

Test Summary:
CheckPatch                    PASS      0.44 seconds
GitLint                       PASS      1.60 seconds
BuildEll                      PASS      19.09 seconds
BluezMake                     PASS      276.95 seconds
MakeCheck                     PASS      0.87 seconds
MakeDistcheck                 PASS      137.12 seconds
CheckValgrind                 PASS      138.78 seconds
CheckSmatch                   WARNING   274.51 seconds
bluezmakeextell               PASS      89.40 seconds
TestFunctional                PASS      1055.53 seconds
IncrementalBuild              PASS      278.11 seconds
ScanBuild                     PASS      1006.35 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
monitor/packet.c:2289:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3925:52: warning: array of flexible structuresmonitor/bt.h:3913:40: warning: array of flexible structures


https://github.com/bluez/bluez/pull/2716

---
Regards,
Linux Bluetooth