In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame<\/p>\n
rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences
\nhdr->addr and hdr->ctrl without validating skb->len first. A truncated
\nframe with skb->len less than the minimum header size causes an
\nout-of-bounds read of uninitialized memory. Additionally, a zero-length
\nframe causes skb->len– to underflow to UINT_MAX, making
\nskb_tail_pointer() read far past the buffer.<\/p>\n
Commit 23882b828c3c (“Bluetooth: RFCOMM: validate skb length in MCC
\nhandlers”) fixed the same class of missing-length-check bugs in the MCC
\nsub-handlers, but the top-level rfcomm_recv_frame() was left unfixed.
\nKMSAN reports:<\/p>\n
BUG: KMSAN: uninit-value in rfcomm_run
\n …
\n Uninit was created at:
\n __alloc_skb+0x474\/0xb60
\n vhci_write+0xe9\/0x870<\/p>\n
Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1
\n(the minimum frame must have a 3-byte header and a 1-byte FCS).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame<\/p>\n
rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferen<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28598","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}