Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2020-12351 PoC — Linux kernel 输入验证错误漏洞

Source
Associated Vulnerability
Title:Linux kernel 输入验证错误漏洞 (CVE-2020-12351)
Description:Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 蓝牙存在输入验证错误漏洞,该漏洞源于实现使用A2MP CID处理L2CAP数据包的方式。攻击者可利用这个漏洞使系统崩溃,从而导致拒绝服务,或者通过发送一个特制的L2CAP包潜在地在系统上执行任意代码。
Description
CVE-2020-12351
Readme
# Linux: Heap-Based Type Confusion in L2CAP (CVE-2020-12351)
**Linux: Heap-Based Type Confusion in L2CAP** PoC (CVE-2020-12351) on BLE implementation

## Why did I modify the original PoC?
The original [PoC][Andy Nguyen, Google Security Research Team] is focused on sending a malicious l2cap packet via Bluetooth Classic. However, I had a requirement to test it against a peripheral that supports only Bluetooth Low Energy (BLE) communication and has adopted the entire BlueZ stack (both classic and LE)

L2CAP is a common protocol that resides in host stack to support both bluetooth classic and BLE implementations


## Prerequisite
Linux Machine with BLE Adapter. If the machine doesn't come with an inbuilt adapter, you can a get an external one

## Usage: 
```sh
1. Compile 
gcc -o CVE-2020-12351 CVE-2020-12351.c -lbluetooth 

2. Run
$./CVE-2020-12351 <BLE_Peripheral_MAC_Address>      //MAC Format: FF:FF:FF:FF:FF:FF

Packet capture:
hcidump -i <hci0> -w CVE-2020-12351.pcap
```

## Acknowledgements
- [Andy Nguyen, Google Security Research Team]


[//]: # (These are reference links used in the body of this note and get stripped out when the markdown processor does its job. There is no need to format nicely because it shouldn't be seen)
   [Andy Nguyen, Google Security Research Team]: <https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq>
   
File Snapshot

[4.0K] /data/pocs/7499f0a858ecfca79d306d8e0a90a1f88a0aa2d5 ├── [6.4K] CVE-2020-12351.c ├── [3.2K] CVE-2020-12351.pcap └── [1.4K] README.md 0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.