Denial Of Service (DOS)

libzephyr.so is vulnerable to Denial Of Service (DOS). The vulnerability is caused by the le_advertising_report function in /subsys/bluetooth/controller/hci/hci.c because an advertising packet is not processed properly when copying data. The root cause of the issue are integer overflow while storing a result in the data_len variable while doing operation (adv->len - BDADDR_SIZE) and buffer overflow while copying data using memcpy function using data_len as the variable to copy the amount of data. A malicious bLE device can cause buffer overflow by sending malformed advertising packet BLE device leading to DoS or potential RCE on the victim BLE device.