Description
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfc_llcp_getsockopt() casts optval to (u32 __user *) for put_user(), so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing min_t(u32, len, sizeof(u32)) only clamps the length reported back to userspace; it does not constrain the store. A call with optlen < 4 therefore writes past the user buffer, violating the getsockopt(2) contract for all five supported optnames. Reject any call with optlen < sizeof(u32) up front. 'len' is int, so a plain size comparison would promote a negative optlen to size_t and slip past the check; an explicit 'len < 0' test is added first to catch negative values before the size compare.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 42859562b7cc4313a84a584f338118edb7087066affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 598dcd53c52f8eeb9dd5382198c03960d5d40fcdaffected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 7e40f2f5e7bc06c3ddef781180ce4f7994176547affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 35573c6cb081af2f4a7caeea291302aca5484526affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < b4c5abaea06292e1dddb70eac1b51589b32c77a3affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < bd6f1277b62bc1df348ca21739df2bc546fcd493affected26fd76cab2e61cedc5c25f7151fb31b57ddc53c7 to < 99985bfa8336fadcc69190ba2dcbd5386af3d661affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/42859562b7cc4313a84a584f338118edb7087066 ↗
- https://git.kernel.org/stable/c/598dcd53c52f8eeb9dd5382198c03960d5d40fcd ↗
- https://git.kernel.org/stable/c/7e40f2f5e7bc06c3ddef781180ce4f7994176547 ↗
- https://git.kernel.org/stable/c/35573c6cb081af2f4a7caeea291302aca5484526 ↗
- https://git.kernel.org/stable/c/b4c5abaea06292e1dddb70eac1b51589b32c77a3 ↗
- https://git.kernel.org/stable/c/8bf228fa02b1ed8ce622fb81fa8edc42be9aeb67 ↗
- https://git.kernel.org/stable/c/bd6f1277b62bc1df348ca21739df2bc546fcd493 ↗
- https://git.kernel.org/stable/c/99985bfa8336fadcc69190ba2dcbd5386af3d661 ↗