In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()<\/p>\n
While rfcomm_recv_frame() verifies that skb->len is at least
\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame
\nwith an extended 2-byte length field (!__test_ea(hdr->len)) has a 4-byte
\nheader plus a 1-byte FCS (5 bytes minimum, sizeof(*hdr) + 2).<\/p>\n
When a 4-byte RFCOMM frame with EA == 0 arrives:
\n1. The initial skb->len < sizeof(*hdr) + 1 check passes (4 len to 3.
\n3. If __check_fcs() succeeds, skb_pull(skb, 4) fails (4 > 3) and returns
\n NULL without advancing skb->data.
\n4. Because the return value of skb_pull() is ignored, the un-pulled
\n 3-byte struct rfcomm_hdr remains at skb->data and is either queued as
\n application payload via rfcomm_recv_data() or parsed as a multiplexer
\n control command via rfcomm_recv_mcc() on DLCI 0.<\/p>\n
Fix this by extending the length check in rfcomm_recv_frame() to also
\nrequire skb->len >= sizeof(*hdr) + 2 when !__test_ea(hdr->len).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()<\/p>\n
While rfcomm_recv_frame() verifies that skb->len is at least
\nsi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41072","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}