Riskcovery

CVE-2024-35966

Bluetooth: RFCOMM: Fix not validating setsockopt user input

State
Published
Severity
Not scored
Published
May 20, 2024
Updated
Oct 15, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix not validating setsockopt user input

syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • bb23c0ab824653be4aa7dfca15b07b3059717004 to before d072ea24748189cd8f4a9c3f585ca9af073a0838Affected
  • bb23c0ab824653be4aa7dfca15b07b3059717004 to before 00767fbd67af70d7a550caa5b12d9515fa978babAffected
  • bb23c0ab824653be4aa7dfca15b07b3059717004 to before eea40d33bf936a5c7fb03c190e61e0cfee00e872Affected
  • bb23c0ab824653be4aa7dfca15b07b3059717004 to before 4ea65e2095e9bd151d0469328dd7fc2858feb546Affected
  • bb23c0ab824653be4aa7dfca15b07b3059717004 to before c3f787a3eafe519c93df9abbb0ca5145861c8d0fAffected
  • bb23c0ab824653be4aa7dfca15b07b3059717004 to before a97de7bff13b1cc825c1b1344eaed8d6c2d3e695Affected
LinuxLinux
  • 2.6.30Affected
  • before 2.6.30Not affected
  • 5.10.234 through 5.10.*Not affected
  • 5.15.178 through 5.15.*Not affected
  • 6.1.107 through 6.1.*Not affected
  • 6.6.47 through 6.6.*Not affected
  • 6.8.7 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.