| Context |
Check |
Description |
| tedd_an/pre-ci_am |
success
|
Success
|
| tedd_an/CheckPatch |
fail
|
ERROR: that open brace { should be on the previous line
#144: FILE: net/bluetooth/hci_conn.c:1615:
+ if (!bacmp(&hdev->bdaddr, dst))
+ {
ERROR: that open brace { should be on the previous line
#162: FILE: net/bluetooth/hci_event.c:3272:
+ if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
+ {
WARNING: line length of 108 exceeds 100 columns
#164: FILE: net/bluetooth/hci_event.c:3274:
+ bt_dev_dbg(hdev, "Reject connection from the device with same BD_ADDR %pMR\n", &ev->bdaddr);
total: 2 errors, 1 warnings, 0 checks, 27 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/src/13405300.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
|
| tedd_an/GitLint |
success
|
Gitlint PASS
|
| tedd_an/SubjectPrefix |
success
|
Gitlint PASS
|
| tedd_an/BuildKernel |
success
|
BuildKernel PASS
|
| tedd_an/CheckAllWarning |
success
|
CheckAllWarning PASS
|
| tedd_an/CheckSparse |
warning
|
CheckSparse WARNING net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
|
| tedd_an/CheckSmatch |
warning
|
CheckSparse WARNING net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
|
| tedd_an/BuildKernel32 |
success
|
BuildKernel32 PASS
|
| tedd_an/TestRunnerSetup |
success
|
TestRunnerSetup PASS
|
| tedd_an/TestRunner_l2cap-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_iso-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_bnep-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_mgmt-tester |
fail
|
TestRunner_mgmt-tester: Total: 497, Passed: 494 (99.4%), Failed: 3, Not Run: 0
|
| tedd_an/TestRunner_rfcomm-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_sco-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_ioctl-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_mesh-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_smp-tester |
success
|
TestRunner PASS
|
| tedd_an/TestRunner_userchan-tester |
success
|
TestRunner PASS
|
| tedd_an/IncrementalBuild |
success
|
Incremental Build PASS
|
@@ -1611,6 +1611,13 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
return ERR_PTR(-EOPNOTSUPP);
}
+ /* Reject outgoing connection to device with same BD ADDR against CVE-2020-26555 */
+ if (!bacmp(&hdev->bdaddr, dst))
+ {
+ bt_dev_dbg(hdev, "Reject connection to the device with same BD_ADDR %pMR\n", dst);
+ return ERR_PTR(-ECONNREFUSED);
+ }
+
acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
if (!acl) {
acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
@@ -3268,6 +3268,14 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
+ /* Reject incoming connection from device with same BD ADDR against CVE-2020-26555 */
+ if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
+ {
+ bt_dev_dbg(hdev, "Reject connection from the device with same BD_ADDR %pMR\n", &ev->bdaddr);
+ hci_reject_conn(hdev, &ev->bdaddr);
+ return;
+ }
+
mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
&flags);
This change is used to relieve CVE-2020-26555. The description of the CVE: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN. [1] The detail of this attack is in IEEE paper: BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols [2] It's a reflection attack. The paper mentioned that attacker can induce the attacked target to generate null link key (zero key) without PIN code. In BR/EDR, the key generation is actually handled in the controller which is below HCI. A condition of this attack is that attacker should change the BR_ADDR of his hacking device (Host B) to equal to the BR_ADDR with the target device being attacked (Host A). Thus, we reject the connection with device which has same BD_ADDR both on HCI_Create_Connection and HCI_Connection_Request to prevent the attack. A similar implementation also shows in btstack project. [3][4] Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26555 [1] Link: https://ieeexplore.ieee.org/abstract/document/9474325/authors#authors [2] Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L3523 [3] Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L7297 [4] Signed-off-by: Lee, Chun-Yi <jlee@suse.com> --- net/bluetooth/hci_conn.c | 7 +++++++ net/bluetooth/hci_event.c | 8 ++++++++ 2 files changed, 15 insertions(+)