Not rated

CVE-2024-35966 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt…

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064

Affected products and versions

Product	Affected versions	Fixed in
Linux 6.9	earliest → < 6.9	6.9
Linux 6.8	earliest → < 6.8.7	6.8.7
Linux 6.6	earliest → < 6.6.47	6.6.47
Linux 6.1	earliest → < 6.1.107	6.1.107
Linux 5.15	earliest → < 5.15.178	5.15.178
Linux 5.10	earliest → < 5.10.234	5.10.234
Linux	2.6.30	No fix stated
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1	earliest → < 1.1.1	1.1.1