High · published May 20, 2024
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix not validating setsockopt user input
syzbot reported rfcomm_sock_setsockopt_old() is copying data without
checking user input length.
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset
include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr
include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old
net/bluetooth/rfcomm/sock.c:632 [inline]
BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70
net/bluetooth/rfcomm/sock.c:673
Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.30, < 5.10.234 | 5.10.234 |
| linux/linux_kernel | ≥ 5.11, < 5.15.178 | 5.15.178 |
| linux/linux_kernel | ≥ 5.16, < 6.1.107 | 6.1.107 |
| linux/linux_kernel | ≥ 6.2, < 6.6.47 | 6.6.47 |
| linux/linux_kernel | ≥ 6.7, < 6.8.7 | 6.8.7 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |