Linux Kernel Bluetooth Command Handling Vulnerability Allowing Buffer Overwrite

A vulnerability in the Linux kernel's Bluetooth management layer has been addressed. The issue arose in the 'mgmt_hci_cmd_sync()' function, where the size of parameters in 'struct mgmt_cp_hci_cmd_sync' was not properly validated against the expected total size. This oversight allowed for large, malformed 'params_len' values to cause 'hci_cmd_sync_alloc()' to write data beyond the allocated buffer, potentially leading to memory corruption.

Impact

Exploitation of this vulnerability could result in a buffer overwrite, causing memory corruption.