Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read. There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes remain, the subtraction wraps; skb_trim() leaves the buffer unchanged and the subsequent FCS load reads past the logical end of the frame. Validate that the frame contains both its control field and, when enabled, its FCS before either field is accessed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < 4373ba79a267947e771c438507f7b103e30bdb21affected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < 965bd88ed4b4763cb765dd65885adcfa588c6b14affected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < 3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70affected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < 8c7556c7cd17e073bbefdc4a9a4694a207544c37affected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < 1fdbb2a712a9a162ee817c959740face80b3d929affected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < c6a288e6001bcce16553c3853e0f5a45eaaf85c7affected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < f557274af7b94b6134692e6f26b880f1e34c15bfaffected1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a to < 6c78a213d9070b610c7f418af2c25b66180b7e37affected
Linux Linux
Default version status: affected
2.6.32affected0 to < 2.6.32unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4373ba79a267947e771c438507f7b103e30bdb21 ↗
- https://git.kernel.org/stable/c/965bd88ed4b4763cb765dd65885adcfa588c6b14 ↗
- https://git.kernel.org/stable/c/3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70 ↗
- https://git.kernel.org/stable/c/8c7556c7cd17e073bbefdc4a9a4694a207544c37 ↗
- https://git.kernel.org/stable/c/1fdbb2a712a9a162ee817c959740face80b3d929 ↗
- https://git.kernel.org/stable/c/c6a288e6001bcce16553c3853e0f5a45eaaf85c7 ↗
- https://git.kernel.org/stable/c/f557274af7b94b6134692e6f26b880f1e34c15bf ↗
- https://git.kernel.org/stable/c/6c78a213d9070b610c7f418af2c25b66180b7e37 ↗