CVE-2023-0396: 
NixOS vulnerability analysis and mitigation

A vulnerability identified as CVE-2023-0396 was discovered in the Zephyr Project's Bluetooth implementation. The vulnerability, disclosed on January 19, 2023, involves buffer overreads in functions that process HCI (Host Controller Interface) command responses when interacting with malicious or defective Bluetooth controllers (Zephyr Advisory).

The vulnerability stems from insufficient buffer length verification in functions utilizing bt_hci_cmd_send_sync to receive HCI command responses. While checks are performed for the bt_hci_evt_cmd_complete header size, the implementation fails to verify if the response length is adequate before casting to the expected response struct. This affects multiple functions including common_init and le_init. The issue is particularly evident in functions like hci_le_read_max_data_len where no size check is performed before casting into bt_hci_rp_le_read_max_data_len (Zephyr Advisory).

The vulnerability can potentially lead to information leakage and denial of service conditions when exploited. The CVSS v3.1 base score is 6.4 (Moderate), with attack vector being Physical, low attack complexity, no privileges required, and no user interaction needed (Zephyr Advisory).

The vulnerability requires physical access to exploit, with low attack complexity and no special privileges or user interaction needed. The attack can be executed through a malicious or defective Bluetooth controller (Zephyr Advisory).

Two potential fixes have been proposed: 1) Adding a mandatory min_size argument to bt_hci_cmd_send_sync similar to the handler->min_len check in handle_event_common, or 2) Verifying the buffer length on each call side of bt_hci_cmd_send_sync before casting (Zephyr Advisory).