In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix not validating setsockopt user input
syzbot reported rfcommsocksetsockopt_old() is copying data without checking user input length.
BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copyfromsockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcommsocksetsockoptold net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcommsocksetsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064
[
{
"id": "CVE-2024-35966-04ef7587",
"target": {
"function": "rfcomm_sock_setsockopt",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ea65e2095e9bd151d0469328dd7fc2858feb546",
"digest": {
"length": 1177.0,
"function_hash": "75079094968385637020828377250220847040"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-12b6e4ec",
"target": {
"function": "rfcomm_sock_setsockopt_old",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3f787a3eafe519c93df9abbb0ca5145861c8d0f",
"digest": {
"length": 762.0,
"function_hash": "88136795137827402872716666605406040057"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-1bc85fed",
"target": {
"function": "rfcomm_sock_setsockopt",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00767fbd67af70d7a550caa5b12d9515fa978bab",
"digest": {
"length": 1177.0,
"function_hash": "75079094968385637020828377250220847040"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-39acd072",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97de7bff13b1cc825c1b1344eaed8d6c2d3e695",
"digest": {
"line_hashes": [
"327191562075095424284609949828199867322",
"165031128671614841647393252067348848553",
"23724831252313291714947301437757147958",
"296544459159507103766289306347962149513",
"283235950761065080524222149655182389697",
"330992264961181590034635758273464638352",
"14509509717218383172497147048311876305",
"311318923464430665091747091196706248953",
"309710178034790122793543885143007647455",
"224493452486830497859557689658164514237",
"304476388917970647082825327780737097378",
"306539280904826656809302360723696540841",
"16061769181507711668734404334366212268",
"338075724236566845174387911549883923478",
"312983894315697526668837096282963164817",
"312120113142385830181562575916797709199",
"146918785957761180903342994980185812851",
"333821079057152553860177944205987969938",
"14133456619170772107471825208980146060",
"296544459159507103766289306347962149513",
"98169667164234217478625593399531834994",
"300862905683415155400858347209140287027",
"336956120794910581488736220815809191235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2024-35966-402b1c5d",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d072ea24748189cd8f4a9c3f585ca9af073a0838",
"digest": {
"line_hashes": [
"327191562075095424284609949828199867322",
"165031128671614841647393252067348848553",
"23724831252313291714947301437757147958",
"296544459159507103766289306347962149513",
"283235950761065080524222149655182389697",
"330992264961181590034635758273464638352",
"14509509717218383172497147048311876305",
"311318923464430665091747091196706248953",
"309710178034790122793543885143007647455",
"224493452486830497859557689658164514237",
"304476388917970647082825327780737097378",
"306539280904826656809302360723696540841",
"16061769181507711668734404334366212268",
"338075724236566845174387911549883923478",
"312983894315697526668837096282963164817",
"312120113142385830181562575916797709199",
"146918785957761180903342994980185812851",
"333821079057152553860177944205987969938",
"14133456619170772107471825208980146060",
"296544459159507103766289306347962149513",
"98169667164234217478625593399531834994",
"300862905683415155400858347209140287027",
"336956120794910581488736220815809191235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2024-35966-45de7077",
"target": {
"function": "rfcomm_sock_setsockopt_old",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea40d33bf936a5c7fb03c190e61e0cfee00e872",
"digest": {
"length": 762.0,
"function_hash": "88136795137827402872716666605406040057"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-6525daa1",
"target": {
"function": "rfcomm_sock_setsockopt_old",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d072ea24748189cd8f4a9c3f585ca9af073a0838",
"digest": {
"length": 762.0,
"function_hash": "88136795137827402872716666605406040057"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-77429403",
"target": {
"function": "rfcomm_sock_setsockopt_old",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00767fbd67af70d7a550caa5b12d9515fa978bab",
"digest": {
"length": 762.0,
"function_hash": "88136795137827402872716666605406040057"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-7f8c8c9d",
"target": {
"function": "rfcomm_sock_setsockopt",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97de7bff13b1cc825c1b1344eaed8d6c2d3e695",
"digest": {
"length": 1177.0,
"function_hash": "75079094968385637020828377250220847040"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-98323545",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ea65e2095e9bd151d0469328dd7fc2858feb546",
"digest": {
"line_hashes": [
"327191562075095424284609949828199867322",
"165031128671614841647393252067348848553",
"23724831252313291714947301437757147958",
"296544459159507103766289306347962149513",
"283235950761065080524222149655182389697",
"330992264961181590034635758273464638352",
"14509509717218383172497147048311876305",
"311318923464430665091747091196706248953",
"309710178034790122793543885143007647455",
"224493452486830497859557689658164514237",
"304476388917970647082825327780737097378",
"306539280904826656809302360723696540841",
"16061769181507711668734404334366212268",
"338075724236566845174387911549883923478",
"312983894315697526668837096282963164817",
"312120113142385830181562575916797709199",
"146918785957761180903342994980185812851",
"333821079057152553860177944205987969938",
"14133456619170772107471825208980146060",
"296544459159507103766289306347962149513",
"98169667164234217478625593399531834994",
"300862905683415155400858347209140287027",
"336956120794910581488736220815809191235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2024-35966-9b9e1b4c",
"target": {
"function": "rfcomm_sock_setsockopt_old",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97de7bff13b1cc825c1b1344eaed8d6c2d3e695",
"digest": {
"length": 762.0,
"function_hash": "88136795137827402872716666605406040057"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-b88640d3",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3f787a3eafe519c93df9abbb0ca5145861c8d0f",
"digest": {
"line_hashes": [
"327191562075095424284609949828199867322",
"165031128671614841647393252067348848553",
"23724831252313291714947301437757147958",
"296544459159507103766289306347962149513",
"283235950761065080524222149655182389697",
"330992264961181590034635758273464638352",
"14509509717218383172497147048311876305",
"311318923464430665091747091196706248953",
"309710178034790122793543885143007647455",
"224493452486830497859557689658164514237",
"304476388917970647082825327780737097378",
"306539280904826656809302360723696540841",
"16061769181507711668734404334366212268",
"338075724236566845174387911549883923478",
"312983894315697526668837096282963164817",
"312120113142385830181562575916797709199",
"146918785957761180903342994980185812851",
"333821079057152553860177944205987969938",
"14133456619170772107471825208980146060",
"296544459159507103766289306347962149513",
"98169667164234217478625593399531834994",
"300862905683415155400858347209140287027",
"336956120794910581488736220815809191235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2024-35966-c7ddd7eb",
"target": {
"function": "rfcomm_sock_setsockopt",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea40d33bf936a5c7fb03c190e61e0cfee00e872",
"digest": {
"length": 1177.0,
"function_hash": "75079094968385637020828377250220847040"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-e1ccb610",
"target": {
"function": "rfcomm_sock_setsockopt",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3f787a3eafe519c93df9abbb0ca5145861c8d0f",
"digest": {
"length": 1177.0,
"function_hash": "75079094968385637020828377250220847040"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-e93d6ab4",
"target": {
"function": "rfcomm_sock_setsockopt",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d072ea24748189cd8f4a9c3f585ca9af073a0838",
"digest": {
"length": 1177.0,
"function_hash": "75079094968385637020828377250220847040"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-ed1953ea",
"target": {
"function": "rfcomm_sock_setsockopt_old",
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ea65e2095e9bd151d0469328dd7fc2858feb546",
"digest": {
"length": 762.0,
"function_hash": "88136795137827402872716666605406040057"
},
"deprecated": false
},
{
"id": "CVE-2024-35966-f3860d0f",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00767fbd67af70d7a550caa5b12d9515fa978bab",
"digest": {
"line_hashes": [
"327191562075095424284609949828199867322",
"165031128671614841647393252067348848553",
"23724831252313291714947301437757147958",
"296544459159507103766289306347962149513",
"283235950761065080524222149655182389697",
"330992264961181590034635758273464638352",
"14509509717218383172497147048311876305",
"311318923464430665091747091196706248953",
"309710178034790122793543885143007647455",
"224493452486830497859557689658164514237",
"304476388917970647082825327780737097378",
"306539280904826656809302360723696540841",
"16061769181507711668734404334366212268",
"338075724236566845174387911549883923478",
"312983894315697526668837096282963164817",
"312120113142385830181562575916797709199",
"146918785957761180903342994980185812851",
"333821079057152553860177944205987969938",
"14133456619170772107471825208980146060",
"296544459159507103766289306347962149513",
"98169667164234217478625593399531834994",
"300862905683415155400858347209140287027",
"336956120794910581488736220815809191235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2024-35966-f8e40ee8",
"target": {
"file": "net/bluetooth/rfcomm/sock.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea40d33bf936a5c7fb03c190e61e0cfee00e872",
"digest": {
"line_hashes": [
"327191562075095424284609949828199867322",
"165031128671614841647393252067348848553",
"23724831252313291714947301437757147958",
"296544459159507103766289306347962149513",
"283235950761065080524222149655182389697",
"330992264961181590034635758273464638352",
"14509509717218383172497147048311876305",
"311318923464430665091747091196706248953",
"309710178034790122793543885143007647455",
"224493452486830497859557689658164514237",
"304476388917970647082825327780737097378",
"306539280904826656809302360723696540841",
"16061769181507711668734404334366212268",
"338075724236566845174387911549883923478",
"312983894315697526668837096282963164817",
"312120113142385830181562575916797709199",
"146918785957761180903342994980185812851",
"333821079057152553860177944205987969938",
"14133456619170772107471825208980146060",
"296544459159507103766289306347962149513",
"98169667164234217478625593399531834994",
"300862905683415155400858347209140287027",
"336956120794910581488736220815809191235"
],
"threshold": 0.9
},
"deprecated": false
}
]