-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description and the ASAN report from the spinics.net URL clearly identify the commands_dump function in tools/parser/csr.c as the location of the buffer overflow. The ASAN report provides the exact line of code (memcpy(commands, frm->ptr, frm->len);) and the stack trace at the time of the crash. The commands array is a fixed-size buffer on the stack (64 bytes). The memcpy operation uses frm->len as the size to copy, which comes from potentially malicious input (a corrupted dump file). There is no check to ensure frm->len is not greater than 64, leading directly to the buffer overflow. No commit information was available to confirm the fix, but the evidence from the ASAN report is strong.
The following functions would appear in a stack trace during exploitation, leading up to the vulnerable function:
main (in tools/hcidump.c)read_dump (in tools/hcidump.c)parse (in tools/parser/parser.h)hci_dump (in tools/parser/hci.c)event_dump (in tools/parser/hci.c)csr_dump (in tools/parser/csr.c)bccmd_dump (in tools/parser/csr.c)pskey_dump (in tools/parser/csr.c)
However, the directly vulnerable function where the overflow occurs is commands_dump.