diff options
| author | Keenan Dong <keenanat2000@gmail.com> | 2026-03-28 16:46:47 +0800 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-04-01 16:46:09 -0400 |
| commit | b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 (patch) | |
| tree | b7000cbd11540ae24da409f381458521797ab0aa /arch/ppc/git@git.tavy.me:linux.git | |
| parent | 0ffac654e95c1bdfe2d4edf28fb18d6ba1f103e6 (diff) | |
Bluetooth: MGMT: validate LTK enc_size on load
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.
Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'arch/ppc/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions