bluetooth OCF Filter Bypass

Vulnerability analysis

The Bluetooth raw socket security filter uses a 128-bit bitmap per command group to track permitted command codes, but the validation logic masked the 10-bit command code with 127 before checking the bitmap. This caused command codes 128–1023 to wrap around and match bits for codes 0–127, allowing an attacker to send reserved commands that the filter incorrectly treated as allowed. The fix adds an explicit range check rejecting any command code greater than 127 before the bitmap lookup, ensuring the security decision applies to the actual command sent to the controller. The vulnerability can be triggered by any local process that can open a raw HCI socket — typically requiring the CAP_NET_RAW capability in the initial namespace, but also reachable from a user namespace where that capability is granted, since the filter's capability check tests the initial namespace.