Linux Kernel Bluetooth L2CAP Channel Identifier Handling Vulnerability

A vulnerability exists in the Linux kernel's Bluetooth implementation, specifically within the L2CAP (Logical Link Control and Adaptation Protocol) layer. The issue arises because the L2CAP Enhanced Credit-Based Mode reconfiguration response handler does not properly clear the channel identifier after a successful operation. This oversight allows a remote attacker, who has completed a reconfiguration as the peer, to replay a failure response using the outdated identifier. As a result, the kernel mistakenly matches the response to an existing channel and terminates it, causing a disruption in the established connection. This vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition by causing the kernel to incorrectly terminate active Bluetooth L2CAP channels, disrupting ongoing connections.

Reproduction

To reproduce this vulnerability, a remote attacker must first complete a reconfiguration with a target device using Bluetooth L2CAP Enhanced Credit-Based Mode. Once the reconfiguration is successful, the attacker can then replay a failure response using the stale channel identifier. The kernel will match this response to the existing L2CAP channel and terminate it, simulating a connection reset error.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.