CVE-2021-47620

What it actually does

Out-of-bounds read in Linux kernel Bluetooth advertisement data parser caused by bounds check occurring after pointer advancement inside num_reports loop, allowing access beyond allocated buffer during malicious adv data processing.

Why it matters to the business

Linux-based systems using Bluetooth may experience crashes, information disclosure, or denial of service when processing crafted advertisement packets, increasing operational risk for devices in IoT, mobile, and embedded environments.

How an attack unfolds

An attacker transmits specially crafted Bluetooth advertisement reports with manipulated num_reports values; the kernel processes the loop, advances the data pointer without prior bounds validation, and performs an out-of-bounds read on the malicious payload.

How to fix it

Apply the upstream kernel patch that moves the malicious adv data bounds check to the start of the num_reports loop; rebuild and deploy updated kernel images across affected Linux distributions.

How to confirm the fix worked

Verify kernel source contains the refactored check at the beginning of the num_reports processing loop; confirm updated kernel versions are running via uname or package manager and test with crafted advertisement injection tools.

Typical attack path

1. Attacker crafts malicious Bluetooth LE advertisement data with excessive or malformed report counts
2. Victim device receives advertisement via Bluetooth stack
3. Kernel enters while num_reports loop and advances data pointer before bounds check
4. Out-of-bounds read occurs on attacker-controlled data
5. Resulting memory access triggers crash, leak, or further exploitation attempts

How to detect it

Review kernel logs for Bluetooth HCI or advertisement parsing errors, unexpected num_reports values, or oops/panic entries related to adv data handling; inspect Bluetooth traffic captures for anomalous report counts.

What your security team should do

• Prioritize kernel updates on all Bluetooth-enabled Linux systems
• Monitor Bluetooth-related kernel logs for abnormal advertisement processing events
• Disable Bluetooth where not required until patches are applied