CVE-2024-35967
Assigner: Linux
Published: 2024-05-20T09:41:56.503Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix not validating setsockopt user input

syzbot reported sco_sock_setsockopt() is copying data without
checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset
include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr
include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90
net/bluetooth/sco.c:893
Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: b96e9c671b05
lessThan: b0e30c37695b
status: affected
versionType: git
version: b96e9c671b05
lessThan: 7bc65d23ba20
status: affected
versionType: git
version: b96e9c671b05
lessThan: 72473db90900
status: affected
versionType: git
version: b96e9c671b05
lessThan: 419a0ffca701
status: affected
versionType: git
version: b96e9c671b05
lessThan: 51eda36d33e4
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 3.8
status: affected
version: 0
lessThan: 3.8
status: unaffected
versionType: custom
version: 5.10.216
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 6.1.87
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.28
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.8.7
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: Bluetooth: SCO: Fix not validating setsockopt user input
x_generator: engine: bippy-d175d3acf727