In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix not validating setsockopt user input
syzbot reported rfcommsocksetsockopt_old() is copying data without checking user input length.
BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copyfromsockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcommsocksetsockoptold net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcommsocksetsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064
{ "vanir_signatures": [ { "digest": { "length": 1177.0, "function_hash": "75079094968385637020828377250220847040" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ea65e2095e9bd151d0469328dd7fc2858feb546", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-04ef7587" }, { "digest": { "length": 762.0, "function_hash": "88136795137827402872716666605406040057" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3f787a3eafe519c93df9abbb0ca5145861c8d0f", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt_old", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-12b6e4ec" }, { "digest": { "length": 1177.0, "function_hash": "75079094968385637020828377250220847040" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00767fbd67af70d7a550caa5b12d9515fa978bab", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-1bc85fed" }, { "digest": { "line_hashes": [ "327191562075095424284609949828199867322", "165031128671614841647393252067348848553", "23724831252313291714947301437757147958", "296544459159507103766289306347962149513", "283235950761065080524222149655182389697", "330992264961181590034635758273464638352", "14509509717218383172497147048311876305", "311318923464430665091747091196706248953", "309710178034790122793543885143007647455", "224493452486830497859557689658164514237", "304476388917970647082825327780737097378", "306539280904826656809302360723696540841", "16061769181507711668734404334366212268", "338075724236566845174387911549883923478", "312983894315697526668837096282963164817", "312120113142385830181562575916797709199", "146918785957761180903342994980185812851", "333821079057152553860177944205987969938", "14133456619170772107471825208980146060", "296544459159507103766289306347962149513", "98169667164234217478625593399531834994", "300862905683415155400858347209140287027", "336956120794910581488736220815809191235" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97de7bff13b1cc825c1b1344eaed8d6c2d3e695", "signature_type": "Line", "target": { "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-39acd072" }, { "digest": { "line_hashes": [ "327191562075095424284609949828199867322", "165031128671614841647393252067348848553", "23724831252313291714947301437757147958", "296544459159507103766289306347962149513", "283235950761065080524222149655182389697", "330992264961181590034635758273464638352", "14509509717218383172497147048311876305", "311318923464430665091747091196706248953", "309710178034790122793543885143007647455", "224493452486830497859557689658164514237", "304476388917970647082825327780737097378", "306539280904826656809302360723696540841", "16061769181507711668734404334366212268", "338075724236566845174387911549883923478", "312983894315697526668837096282963164817", "312120113142385830181562575916797709199", "146918785957761180903342994980185812851", "333821079057152553860177944205987969938", "14133456619170772107471825208980146060", "296544459159507103766289306347962149513", "98169667164234217478625593399531834994", "300862905683415155400858347209140287027", "336956120794910581488736220815809191235" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d072ea24748189cd8f4a9c3f585ca9af073a0838", "signature_type": "Line", "target": { "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-402b1c5d" }, { "digest": { "length": 762.0, "function_hash": "88136795137827402872716666605406040057" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea40d33bf936a5c7fb03c190e61e0cfee00e872", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt_old", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-45de7077" }, { "digest": { "length": 762.0, "function_hash": "88136795137827402872716666605406040057" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d072ea24748189cd8f4a9c3f585ca9af073a0838", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt_old", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-6525daa1" }, { "digest": { "length": 762.0, "function_hash": "88136795137827402872716666605406040057" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00767fbd67af70d7a550caa5b12d9515fa978bab", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt_old", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-77429403" }, { "digest": { "length": 1177.0, "function_hash": "75079094968385637020828377250220847040" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97de7bff13b1cc825c1b1344eaed8d6c2d3e695", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-7f8c8c9d" }, { "digest": { "line_hashes": [ "327191562075095424284609949828199867322", "165031128671614841647393252067348848553", "23724831252313291714947301437757147958", "296544459159507103766289306347962149513", "283235950761065080524222149655182389697", "330992264961181590034635758273464638352", "14509509717218383172497147048311876305", "311318923464430665091747091196706248953", "309710178034790122793543885143007647455", "224493452486830497859557689658164514237", "304476388917970647082825327780737097378", "306539280904826656809302360723696540841", "16061769181507711668734404334366212268", "338075724236566845174387911549883923478", "312983894315697526668837096282963164817", "312120113142385830181562575916797709199", "146918785957761180903342994980185812851", "333821079057152553860177944205987969938", "14133456619170772107471825208980146060", "296544459159507103766289306347962149513", "98169667164234217478625593399531834994", "300862905683415155400858347209140287027", "336956120794910581488736220815809191235" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ea65e2095e9bd151d0469328dd7fc2858feb546", "signature_type": "Line", "target": { "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-98323545" }, { "digest": { "length": 762.0, "function_hash": "88136795137827402872716666605406040057" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97de7bff13b1cc825c1b1344eaed8d6c2d3e695", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt_old", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-9b9e1b4c" }, { "digest": { "line_hashes": [ "327191562075095424284609949828199867322", "165031128671614841647393252067348848553", "23724831252313291714947301437757147958", "296544459159507103766289306347962149513", "283235950761065080524222149655182389697", "330992264961181590034635758273464638352", "14509509717218383172497147048311876305", "311318923464430665091747091196706248953", "309710178034790122793543885143007647455", "224493452486830497859557689658164514237", "304476388917970647082825327780737097378", "306539280904826656809302360723696540841", "16061769181507711668734404334366212268", "338075724236566845174387911549883923478", "312983894315697526668837096282963164817", "312120113142385830181562575916797709199", "146918785957761180903342994980185812851", "333821079057152553860177944205987969938", "14133456619170772107471825208980146060", "296544459159507103766289306347962149513", "98169667164234217478625593399531834994", "300862905683415155400858347209140287027", "336956120794910581488736220815809191235" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3f787a3eafe519c93df9abbb0ca5145861c8d0f", "signature_type": "Line", "target": { "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-b88640d3" }, { "digest": { "length": 1177.0, "function_hash": "75079094968385637020828377250220847040" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea40d33bf936a5c7fb03c190e61e0cfee00e872", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-c7ddd7eb" }, { "digest": { "length": 1177.0, "function_hash": "75079094968385637020828377250220847040" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3f787a3eafe519c93df9abbb0ca5145861c8d0f", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-e1ccb610" }, { "digest": { "length": 1177.0, "function_hash": "75079094968385637020828377250220847040" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d072ea24748189cd8f4a9c3f585ca9af073a0838", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-e93d6ab4" }, { "digest": { "length": 762.0, "function_hash": "88136795137827402872716666605406040057" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ea65e2095e9bd151d0469328dd7fc2858feb546", "signature_type": "Function", "target": { "function": "rfcomm_sock_setsockopt_old", "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-ed1953ea" }, { "digest": { "line_hashes": [ "327191562075095424284609949828199867322", "165031128671614841647393252067348848553", "23724831252313291714947301437757147958", "296544459159507103766289306347962149513", "283235950761065080524222149655182389697", "330992264961181590034635758273464638352", "14509509717218383172497147048311876305", "311318923464430665091747091196706248953", "309710178034790122793543885143007647455", "224493452486830497859557689658164514237", "304476388917970647082825327780737097378", "306539280904826656809302360723696540841", "16061769181507711668734404334366212268", "338075724236566845174387911549883923478", "312983894315697526668837096282963164817", "312120113142385830181562575916797709199", "146918785957761180903342994980185812851", "333821079057152553860177944205987969938", "14133456619170772107471825208980146060", "296544459159507103766289306347962149513", "98169667164234217478625593399531834994", "300862905683415155400858347209140287027", "336956120794910581488736220815809191235" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00767fbd67af70d7a550caa5b12d9515fa978bab", "signature_type": "Line", "target": { "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-f3860d0f" }, { "digest": { "line_hashes": [ "327191562075095424284609949828199867322", "165031128671614841647393252067348848553", "23724831252313291714947301437757147958", "296544459159507103766289306347962149513", "283235950761065080524222149655182389697", "330992264961181590034635758273464638352", "14509509717218383172497147048311876305", "311318923464430665091747091196706248953", "309710178034790122793543885143007647455", "224493452486830497859557689658164514237", "304476388917970647082825327780737097378", "306539280904826656809302360723696540841", "16061769181507711668734404334366212268", "338075724236566845174387911549883923478", "312983894315697526668837096282963164817", "312120113142385830181562575916797709199", "146918785957761180903342994980185812851", "333821079057152553860177944205987969938", "14133456619170772107471825208980146060", "296544459159507103766289306347962149513", "98169667164234217478625593399531834994", "300862905683415155400858347209140287027", "336956120794910581488736220815809191235" ], "threshold": 0.9 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eea40d33bf936a5c7fb03c190e61e0cfee00e872", "signature_type": "Line", "target": { "file": "net/bluetooth/rfcomm/sock.c" }, "deprecated": false, "signature_version": "v1", "id": "CVE-2024-35966-f8e40ee8" } ] }