Bluetooth Key Negotiation Security Notice (CVE-2019-9506)

# Clone the BlueZ repository
$ git clone git://git.kernel.org/pub/scm/bluetooth/bluez.git
$ cd bluez
 
# Configure and build
$ ./configure --enable-maintainer-mode
$ make
 
# Copy configuration file which specifies the required security policies
$ sudo cp ./src/bluetooth.conf /etc/dbus-1/system.d/
 
# Run daemon in foreground with debugging
$ sudo ./src/bluetoothd -n -d -f ./src/main.conf

bool mesh_crypto_aes_ccm_encrypt(const uint8_t nonce[13], const uint8_t key[16],
					const uint8_t *aad, uint16_t aad_len,
					const uint8_t *msg, uint16_t msg_len,
					uint8_t *out_msg,
					void *out_mic, size_t mic_size)
{
	uint8_t pmsg[16], cmic[16], cmsg[16];
	uint8_t mic[16], Xn[16];
	uint16_t blk_cnt, last_blk;
	bool result;
	size_t i, j;
	int fd;
 
	/* Mesh limits AAD length to 16 */
	if (aad_len > 16)
		return false;
 
	fd = aes_ecb_setup(key);
	if (fd < 0)
		return false;
 
	/* C_mic = e(AppKey, 0x01 || nonce || 0x0000) */
	pmsg[0] = 0x01;
	memcpy(pmsg + 1, nonce, 13);
	l_put_be16(0x0000, pmsg + 14);
 
        printf("\n Key and message length failure \n");
	// Validate that pmsg (plaintext message meets a specific length)
	// and the key meet a specific length here.
	// A minimum encryption key length of 7 octets for BR/EDR connections. 
        //
	// If not, close the file descriptor and return fals
	// aes_ecb_destroy(fd);
	// return false;
 
	result = aes_ecb(fd, pmsg, cmic);
	if (!result)
		goto done;
 
	// ...
}

int hci_authenticate_link(int dd, uint16_t handle, int to)
{
	auth_requested_cp cp;
	evt_auth_complete rp;
	struct hci_request rq;
 
	cp.handle = handle;
 
	rq.ogf    = OGF_LINK_CTL;
	rq.ocf    = OCF_AUTH_REQUESTED;
	rq.event  = EVT_AUTH_COMPLETE;
	rq.cparam = &cp;
	rq.clen   = AUTH_REQUESTED_CP_SIZE;
	rq.rparam = &rp;
	rq.rlen   = EVT_AUTH_COMPLETE_SIZE;
 
	if (hci_send_req(dd, &rq, to) < 0)
		return -1;
 
	if (rp.status) {
		errno = EIO;
		return -1;
	}
 
	return 0;
}