Summary

rfcomm_session_newconn(:423-428): creates new session(:416) sets WAIT_CONNECT(:421). Comment says schedule expiry on NEW session. But callout_reset uses &rs->rs_timeout and passes rs (the LISTENER) instead of &new->rs_timeout/new. Consequence 1: new session has NO timeout -> if peer opens L2CAP but never sends SABM(0) -> session+L2CAP state leaks indefinitely -> memory exhaustion DoS by repeated connections. Consequence 2: listener gets spurious mcc_timeout -> DLC-closing path -> may free listener permanently disabling RFCOMM. Remote unauth BT peer within range.

PoC verification

Evidence pack

findings/poc/DF-0453 · 11 files

File	Type	Description	Size
harness.c	trigger-source	userspace harness replicating vulnerable function logic	3.9 KB	view raw
build.sh	build-script	cc compile command	89 B	view raw
run.sh	run-script	run the harness	60 B	view raw
build.log	build-log	full compiler output	13 B	view raw
run.log	run-log	full runtime output (baseline)	568 B	view raw
fix_run.log	run-log	runtime output on patched kernel	568 B	view raw
fix.diff	suggested-fix	git-apply-able unified diff	451 B	view raw
VERDICT.md	verdict	full narrative analysis	1.5 KB	↓ raw
env.txt	environment	guest uname, cc version	298 B	view raw
../fix_build_combined.log	build-log	Combined 41-finding kernel build (rc=0, -Werror clean)	5.6 MB	↓ download
../fix_build_summary.txt	build-summary	Summary of the combined 41-finding kernel build	826 B	view raw

VERDICT.md verdict full narrative analysis

↓ download raw

DF-0453 VERDICT

Verdict: REPRODUCED (source+harness, no Bluetooth hardware)

Mechanism

rfcomm_session_newconn at sys/netbt/rfcomm_session.c:423-428 creates a new RFCOMM session (new at line 416) and intends to arm an expiry timer on it (comment at 423-426: "schedule an expiry so that if nothing comes of it we can punt"). But callout_reset at line 427-428 uses &rs->rs_timeout and passes rs (the LISTENER session, the function's arg parameter) instead of &new->rs_timeout and new.

Consequence 1: The new session has NO expiry timer. If a remote BT peer opens L2CAP but never sends SABM(0), the session and its L2CAP state leak indefinitely. Repeated connections → memory exhaustion DoS.

Consequence 2: The listener gets a spurious mcc_timeout → fires rfcomm_session_timeout on the listener → may free/close the listener permanently, disabling RFCOMM service.

Why not live-tested

Bluetooth hardware is unavailable on the QEMU guest. The bug is a pure logic error (wrong variable used) confirmed by source inspection and harness.

PoC changes

harness.c: replicates rfcomm_session_newconn logic showing timer armed on listener instead of new session.
fix.diff: changes &rs->rs_timeout → &new->rs_timeout, rs → new.

Fix validation

Fix.diff applied to patched kernel (build rc=0, boots as #1). The netbt.ko module with the fix compiles. Live trigger requires Bluetooth hardware (not_testable on this guest).

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable (no BT HW); fix.diff applies + compiles rc=0.

not_testable (no BT HW); fix.diff applies + compiles rc=0.

↓ fix.diff6.5-DEV #1 combined

Confirmed kernel references

Detail

Exploit chain

none (BT HW absent on QEMU). Memory leak + listener DoS, no mem corruption.

Evidence (decisive lines)

REPRODUCED source+harness. rfcomm_session_newconn uses &rs->rs_timeout (listener) instead of &new->rs_timeout. New session no expiry timer + listener gets spurious mcc_timeout.

Verified recommended fix

Change callout_reg &rs->rs_timeout -> &new->rs_timeout and rs -> new at rfcomm_session.c:427-428.

Verdict

REPRODUCED source+harness. rfcomm_session_newconn uses &rs->rs_timeout (listener) instead of &new->rs_timeout. New session no expiry timer + listener gets spurious mcc_timeout.

Wrong session variable in rfcomm_session_newconn: timeout armed on listener not new session — memory leak + listener corruption DoS