bluetooth MGMT LTK Overflow

Vulnerability analysis

The vulnerability occurs in the Bluetooth management interface's Long Term Key (LTK) loading functionality. The mgmt_ltk_info structure accepts a user-provided enc_size field without validation, storing it for later use in stack operations. When replying to LE LTK requests, the kernel uses this enc_size to size fixed-size stack buffers, but the validation function ltk_is_valid() did not check if enc_size exceeds the 16-byte key buffer size. An attacker can provide an enc_size larger than sizeof(key->val) (16 bytes), causing stack buffer overflow when the kernel processes LTK requests. The fix adds a bounds check in ltk_is_valid() to reject LTK records where enc_size exceeds the key buffer size, preventing invalid keys from reaching the stored state. This requires local access with Bluetooth management capabilities (typically CAP_NET_ADMIN or equivalent privileges).