In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the at…
High CVSS 7.1
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that opt->len bytes are present in the buffer. The callers (l2cap_parse_conf_req(), l2cap_parse_conf_rsp…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856
- https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a
- https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606
- https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b
- https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225
- https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b
- https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619
- https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd
Timeline
- nvd_ingest NVD