NetSight
IP …
high7.1

CVE-2024-35967

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockop…

Impact

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.8 before 5.10.216
from 5.11 before 5.15.178
from 5.16 before 6.1.87
from 6.2 before 6.6.28
from 6.7 before 6.8.7
Version 6.9
DebianDebian Linux
Version 10.0

Weakness classification

CWE-125

References