CVE-2024-36915

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0

Description The vulnerability is related to unsafe copies in the nfc llcp setsockopt() function. Syzbot reported unsafe calls to copy from sockptr(). The issue can be resolved by using copy safe from sockptr() instead. The vulnerability is caused by a slab-out-of-bounds error in copy from sockptr offset and copy from sockptr functions. The error occurs when reading a size of 4 at address ffff88801caa1ec3 by task syz-executor459/5078. The call trace indicates that the issue is related to the nfc llcp setsockopt+0x6c2/0x850 function in net/nfc/llcp sock.c.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the nfc llcp setsockopt() function. As a temporary workaround, consider disabling the nfc llcp setsockopt() function until a patch is available.