Zephyr Bluetooth Host vulnerabilities

A vulnerability in the Zephyr Bluetooth stack affects bt_hfp_hf_connect(), which wipes the entire HFP Hands-Free object when bt_rfcomm_dlc_connect() fails, even though the associated SDP discovery is still outstanding. This leads to use-after-free, including NULL pointer dereferences and a self-referential SDP request list, causing a fault or unrecoverable hang in the Bluetooth host thread. The flaw is remotely reachable, e.g., via a device advertising an RFCOMM channel outside 1-30 or controlling connection timing.

A vulnerability in the Zephyr Bluetooth host causes incorrect attribution of a bt_conn reservation to an advertising set during incoming peripheral connections. When multiple extended advertising sets are enabled (CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1), find_pending_connect() may return a reservation belonging to a different, still-running set, permanently leaking a connection slot. An adjacent attacker can exploit this over the air without authentication, exhausting the connection pool and causing denial of service.

A vulnerability in the Zephyr Bluetooth host stack causes a double-free of a net_buf in the ATT transmit path when signing fails. Additionally, on a bt_l2cap_send_pdu() failure, a buffer may be reused with a stale signature, leading to an out-of-bounds write. This results in memory corruption, crashes, or potential code execution.

A vulnerability in the parse_read_std_char_desc() function in the Bluetooth host subsystem (subsys/bluetooth/host/gatt.c) allows a remote, unauthenticated device to hang the Bluetooth processing thread by sending an ATT response with a zero entry length (rsp->len = 0). The parsing loop does not validate the minimum value of rsp->len, leading to an infinite loop (CWE-835) and failure to terminate descriptor discovery.

In the Bluetooth host stack, during L2CAP LE CoC SDU reassembly, a remote unauthenticated BLE peer can trigger a 2-byte out-of-bounds write. This occurs when segmentation is enabled and the chosen RX pool has user_data_size smaller than 2 bytes, causing the segmentation counter to be written out of bounds in l2cap_chan_le_recv_seg.