Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
aac23bf636593cc2d67144aed373a46a1a5f76b1 to < cef09691cfb61f6c91cc27c3d69634f81c8ab949affectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < 3340be2bafdcc806f048273ea6d8e82a6597aa1baffectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < e47315b84d0eb188772c3ff5cf073cdbdefca6b4affectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < 477ad4976072056c348937e94f24583321938df4affectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < 40c7f7eea2f4d9cb0b3e924254c8c9053372168faffectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < 8c96f3bd4ae0802db90630be8e9851827e9c9209affectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < 5ad981249be52f5e4e92e0e97b436b569071cb86affectedaac23bf636593cc2d67144aed373a46a1a5f76b1 to < c65bd945d1c08c3db756821b6bf9f1c4a77b29c6affected
Linux Linux
Default version status: affected
3.14affected0 to < 3.14unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.131 to ≤ 6.6.*unaffected6.12.80 to ≤ 6.12.*unaffected6.18.21 to ≤ 6.18.*unaffected6.19.11 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cef09691cfb61f6c91cc27c3d69634f81c8ab949 ↗
- https://git.kernel.org/stable/c/3340be2bafdcc806f048273ea6d8e82a6597aa1b ↗
- https://git.kernel.org/stable/c/e47315b84d0eb188772c3ff5cf073cdbdefca6b4 ↗
- https://git.kernel.org/stable/c/477ad4976072056c348937e94f24583321938df4 ↗
- https://git.kernel.org/stable/c/40c7f7eea2f4d9cb0b3e924254c8c9053372168f ↗
- https://git.kernel.org/stable/c/8c96f3bd4ae0802db90630be8e9851827e9c9209 ↗
- https://git.kernel.org/stable/c/5ad981249be52f5e4e92e0e97b436b569071cb86 ↗
- https://git.kernel.org/stable/c/c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ↗