ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response.
The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Характеристики атаки
Способ атаки
Смежная сеть
Нужен доступ к локальной сети
Сложность
Низкая
Легко эксплуатировать
Нужны права
Не требуются
Права не нужны
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Высокое
Полная утечка данных
Целостность
Нет
Нет модификации данных
Доступность
Нет
Нет нарушения работы
Строка CVSS v3.1
Тип уязвимости (CWE)
Ссылки 13
https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd…
security-advisories@github.com
https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca…
security-advisories@github.com
https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c…
security-advisories@github.com
https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4…
security-advisories@github.com
https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04…
security-advisories@github.com
https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0e…
security-advisories@github.com
https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9…
security-advisories@github.com
https://github.com/espressif/esp-idf/releases/tag/v5.2.8
security-advisories@github.com
https://github.com/espressif/esp-idf/releases/tag/v5.3.6
security-advisories@github.com
https://github.com/espressif/esp-idf/releases/tag/v5.5.5
security-advisories@github.com
https://github.com/espressif/esp-idf/releases/tag/v6.0.3
security-advisories@github.com
https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1
security-advisories@github.com
https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44
security-advisories@github.com