Skip to content
Fencer Vulns
high 7.1

CVE-2024-36915 json

nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies

published 2024-05-30 2 y ago modified 2026-08-05 3 mo ago also EUVD-2024-36266

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies

syzbot reported unsafe calls to copy_from_sockptr() [1]

Use copy_safe_from_sockptr() instead.

[1]

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255 Read of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078

CPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255 do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfd/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f7fac07fd89 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89 RDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Patch / fix

  • Linux Linux 6.1.119, 6.6.47, 6.8.10, 6.9
  • linux Debian 12 6.1.119-1
  • linux Debian 14, Debian 13 6.8.11-1

debian advisories DEBIAN-CVE-2024-36915

  • linux Ubuntu 24.04 LTS 6.8.0-40.40
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1013.14
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1012.13
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1008.11
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1010.10
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1012.14
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1009.10
  • linux-riscv Ubuntu 24.04 LTS 6.8.0-40.40.1

ubuntu advisories UBUNTU-CVE-2024-36915

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-64kb SLE High Performance Computing 15 SP5-ESPOS, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS 5.14.21-150500.55.91.1
  • kernel-syms SLE High Performance Computing 15 SP5-ESPOS, SLES for SAP 15 SP5, SLES 15 SP5-LTSS +1 more 5.14.21-150500.55.91.1
  • kernel-source SLE High Performance Computing 15 SP5-ESPOS, SLES for SAP 15 SP5, SLES 15 SP5-LTSS +1 more 5.14.21-150500.55.91.1
  • kernel-default SLE Micro 5.5, SLE High Performance Computing 15 SP5-ESPOS, SLES for SAP 15 SP5 +3 more 5.14.21-150500.55.91.1
  • kernel-obs-build SLE High Performance Computing 15 SP5-ESPOS, SLES for SAP 15 SP5, SLES 15 SP5-LTSS +1 more 5.14.21-150500.55.91.1
  • kernel-default-base SLE Micro 5.5, SLE High Performance Computing 15 SP5-ESPOS, SLES for SAP 15 SP5 +2 more 5.14.21-150500.55.91.1.150500.6.41.1
  • kernel-rt Linux Micro 6.0 6.4.0-9.1
  • kernel-source-rt Linux Micro 6.0 6.4.0-9.1

suse advisories SUSE-SU-2025:0201-1SUSE-SU-2025:0201-2SUSE-SU-2025:20028-1SUSE-SU-2025:20008-1SUSE-SU-2025:0289-1SUSE-SU-2025:0229-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-36915 updated cvss 5.5

kernel: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.