mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-19 15:32:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

bluez5: fix CVE-2021-3658

Browse Source 
adapter incorrectly restores Discoverable state after powered down

Upstream-Status: Backport [b497b5942a]
CVE: CVE-2021-3658
(From OE-Core rev: 12669ab256a3ffbcb4bcbaba1bc9c690920d32b1)

Signed-off-by:Minjae Kim <flowergom@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Minjae Kim
2022-03-19 23:40:52 +01:00
committed by Richard Purdie
parent 094a9a9a23
commit 8b369ca021
2 changed files with 96 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-connectivity/bluez5/bluez5.inc
View File

@@ -54,6 +54,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-test-gatt-Fix-hung-issue.patch \
file://CVE-2021-0129.patch \
file://CVE-2021-3588.patch \
file://CVE-2021-3658.patch \
"
S = "${WORKDIR}/bluez-${PV}"

95
meta/recipes-connectivity/bluez5/bluez5/CVE-2021-3658.patch Normal file
View File

@@ -0,0 +1,95 @@
From b497b5942a8beb8f89ca1c359c54ad67ec843055 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 24 Jun 2021 16:32:04 -0700
Subject: [PATCH] adapter: Fix storing discoverable setting
discoverable setting shall only be store when changed via Discoverable
property and not when discovery client set it as that be considered
temporary just for the lifetime of the discovery.
Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055]
Signed-off-by:Minjae Kim <flowergom@gmail.com>
---
src/adapter.c | 35 ++++++++++++++++++++++-------------
1 file changed, 22 insertions(+), 13 deletions(-)
diff --git a/src/adapter.c b/src/adapter.c
index 12e4ff5c0..663b778e4 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -560,7 +560,11 @@ static void settings_changed(struct btd_adapter *adapter, uint32_t settings)
if (changed_mask & MGMT_SETTING_DISCOVERABLE) {
g_dbus_emit_property_changed(dbus_conn, adapter->path,
ADAPTER_INTERFACE, "Discoverable");
- store_adapter_info(adapter);
+ /* Only persist discoverable setting if it was not set
+ * temporarily by discovery.
+ */
+ if (!adapter->discovery_discoverable)
+ store_adapter_info(adapter);
btd_adv_manager_refresh(adapter->adv_manager);
}
@@ -2162,8 +2166,6 @@ static bool filters_equal(struct mgmt_cp_start_service_discovery *a,
static int update_discovery_filter(struct btd_adapter *adapter)
{
struct mgmt_cp_start_service_discovery *sd_cp;
- GSList *l;
-
DBG("");
@@ -2173,17 +2175,24 @@ static int update_discovery_filter(struct btd_adapter *adapter)
return -ENOMEM;
}
- for (l = adapter->discovery_list; l; l = g_slist_next(l)) {
- struct discovery_client *client = l->data;
+ /* Only attempt to overwrite current discoverable setting when not
+ * discoverable.
+ */
+ if (!(adapter->current_settings & MGMT_OP_SET_DISCOVERABLE)) {
+ GSList *l;
- if (!client->discovery_filter)
- continue;
+ for (l = adapter->discovery_list; l; l = g_slist_next(l)) {
+ struct discovery_client *client = l->data;
- if (client->discovery_filter->discoverable)
- break;
- }
+ if (!client->discovery_filter)
+ continue;
- set_discovery_discoverable(adapter, l ? true : false);
+ if (client->discovery_filter->discoverable) {
+ set_discovery_discoverable(adapter, true);
+ break;
+ }
+ }
+ }
/*
* If filters are equal, then don't update scan, except for when
@@ -2216,8 +2225,7 @@ static int discovery_stop(struct discovery_client *client)
return 0;
}
- if (adapter->discovery_discoverable)
- set_discovery_discoverable(adapter, false);
+ set_discovery_discoverable(adapter, false);
/*
* In the idle phase of a discovery, there is no need to stop it
@@ -6913,6 +6921,7 @@ static void adapter_stop(struct btd_adapter *adapter)
g_free(adapter->current_discovery_filter);
adapter->current_discovery_filter = NULL;
+ set_discovery_discoverable(adapter, false);
adapter->discovering = false;
while (adapter->connections) {
--
2.25.1