SeungJu CheonandGreg Kroah-Hartman 0d637136ce Bluetooth: RFCOMM: validate skb length in MCC handlers ...

[ Upstream commit 23882b828c ]

The RFCOMM MCC handlers cast skb->data to protocol-specific structs
without validating skb->len first. A malicious remote device can send
truncated MCC frames and trigger out-of-bounds reads in these handlers.

Fix this by using skb_pull_data() to validate and access the required
data before dereferencing it.

rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows
1-byte RPN requests. Handle this by validating only the DLCI byte first,
and validating the full struct only when len > 1.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Suggested-by: Muhammad Bilal <meatuni001@gmail.com>
Signed-off-by: SeungJu Cheon <suunj1331@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-19 13:37:09 +02:00

..

core.c

Bluetooth: RFCOMM: validate skb length in MCC handlers

2026-06-19 13:37:09 +02:00

Kconfig

…

Makefile

…

sock.c

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

2026-06-19 13:37:09 +02:00

tty.c

…