Linux Kernel Bluetooth HIDP Input Report Length Check Vulnerability

A vulnerability in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) handling has been addressed. The issue arose because the input report function did not properly check the length of the received data before processing it. This oversight could lead to out-of-bounds reads from the data buffer, especially if a paired device sent a truncated packet. Such out-of-bounds reads could be misinterpreted as phantom key presses or unintended mouse movements.

Impact

Exploitation of this vulnerability could result in out-of-bounds memory reads, potentially leading to the misinterpretation of input devices, such as keyboards or mice, causing erroneous input actions.

Reproduction

The vulnerability can be reproduced by pairing a Bluetooth device that sends HID reports, such as a keyboard or mouse, with a device running an affected version of the Linux kernel. If the paired device transmits a truncated HID report, the kernel will read beyond the valid data boundaries, creating an out-of-bounds read. This can be observed as phantom key presses or unintended mouse movements.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.