CVE-2026-77684 Fuga de búfer de transmisión en HFP Hands-Free de Bluetooth Classic

Qué es CVE-2026-77684

En subsys/bluetooth/host/classic/hfp_hf.c, hfp_hf_disconnected() no libera los búferes de comandos AT pendientes en hf-tx_pending cuando cae el DLC RFCOMM, por lo que se pierden permanentemente del hf_pool fijo. Un peer Audio Gateway remoto puede desencadenar la falla sin intervención de la aplicación y provocar una denegación de servicio permanente de Bluetooth.

Productos y versiones afectadas

• zephyrproject zephyr

  • desde 4.2.0 hasta 4.4.2

Qué hacer

1. Verificá si usás zephyr y en qué versión: el rango afectado figura arriba.
2. Actualizá a la versión corregida que indique el fabricante en su aviso (ver referencias) o aplicá la mitigación que publique.
3. Revisá registros y accesos de los sistemas expuestos para descartar que se haya aprovechado antes de corregir.

Calculadora CVSS

CVSS 3.1 · 5.7 MEDIA

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

VECTOR DE ATAQUE (AV)

Red adyacente

COMPLEJIDAD DEL ATAQUE (AC)

Baja

PRIVILEGIOS REQUERIDOS (PR)

Bajos

INTERACCIÓN DEL USUARIO (UI)

Ninguna

ALCANCE (S)

Sin cambio

CONFIDENCIALIDAD (C)

Ninguna

INTEGRIDAD (I)

Ninguna

DISPONIBILIDAD (A)

Alta

Abrir la calculadora completa →

Descripción original

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running. The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good. With the pool exhausted, HFP command sending fails permanently, and because hfp_hf_send_cmd() allocates with K_FOREVER (bt_rfcomm_create_pdu() → bt_conn_create_pdu()) from the Bluetooth RX context — where that timeout is not downgraded to K_NO_WAIT — one further +BCS from the peer parks the Bluetooth RX thread inside net_buf_alloc() with no possible waker, halting all HCI event processing until the device is rebooted. Separately, reusing the HF slot while a work handler was still queued or running allowed memset() to wipe live k_work items out from under the system workqueue, corrupting shared kernel workqueue state. Exploitation requires an established HFP session (for SSP devices L2CAP enforces authentication before the RFCOMM channel is reachable) and a build with CONFIG_BT_HFP_HF enabled.

Referencias

• github.com/zephyrproject-rtos/zephyr/commit/59c947c71f3d9ab4cf10fd28846e6ca4a3d53819PATCH
• github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hc6x-8gm2-2r9v

Historial de la alerta

1. 19 OCT · 22:37VULNERABILIDAD Nueva vulnerabilidad detectada.

CÓMO SE HIZOResumen traducido automáticamente al español a partir de la descripción original. Ante dudas, la descripción original y las referencias del fabricante son la fuente de verdad. Cómo funciona.