CVE-2024-35966: Bluetooth: RFCOMM: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix not validating setsockopt user input
syzbot reported rfcommsocksetsockoptold() is copying data without checking user input length.
BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copyfromsockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcommsocksetsockoptold net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcommsocksetsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix not validating setsockopt user input
The Linux kernel CVE team has assigned CVE-2024-35966 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052021-CVE-2024-35966-e107@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35966?
CVE-2024-35966 is classified as a significant vulnerability affecting the Linux kernel related to Bluetooth RFCOMM.
How do I fix CVE-2024-35966?
To mitigate CVE-2024-35966, upgrade to the patched versions of 'linux' or 'linux-6.1' as specified in the affected software list.
Which Linux kernel versions are affected by CVE-2024-35966?
CVE-2024-35966 affects Linux kernel versions up to and including 5.10.226-1.
What component is impacted by CVE-2024-35966?
CVE-2024-35966 impacts the Bluetooth subsystem, specifically the RFCOMM component.
Is there any workaround for CVE-2024-35966?
No specific workaround is recommended for CVE-2024-35966, the best course of action is to apply the available patches.