CVE-2017-1000250: Infoleak

Information disclosure vulnerability due to out-of-bounds heap read in servicesearchattrreq function when processing of incoming requests in the SDP server was found. Unauthenticated attacker can exploit this vulnerability to read potentially sensitive data from heap of the bluetoothd process.

Vulnerable code:

... } else { / continuation State exists -> get from cache / sdpbuft pCache = sdpgetcachedrsp(cstate); if (pCache) { uint16t sent = MIN(max, pCache->datasize - cstate->cStateValue.maxBytesSent); pResponse = pCache->data; memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent); buf->datasize += sent; cstate->cStateValue.maxBytesSent += sent; if (cstate->cStateValue.maxBytesSent == pCache->datasize) cstatesize = sdpsetcstatepdu(buf, NULL); else cstatesize = sdpsetcstatepdu(buf, cstate); } else { status = SDPINVALIDCSTATE; SDPDBG("Non-null continuation state, but null cache buffer"); } } ...

When a long response is returned to a specific search attribute request, a continuation state is returned to allow reception of additional fragments, via additional requests that contain the last continuation state sent. However, the incoming “cstate” that requests additional fragments isn’t validated properly, and thus an out-of-bounds read of the response buffer (pResponse) can be achieved, leading to information disclosure of the heap.

— Red Hat