CVE-2024-35965: Bluetooth: L2CAP: Fix not validating setsockopt user input

High severity · published May 20, 2024

CVE-2024-35965

Bluetooth: L2CAP: Fix not validating setsockopt user input

7.1

CVSS

0.2%

EPSS

On KEV

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user input length before copying data.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 15% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

2.6.39 before 5.10.227; 5.11 before 6.1.87; 6.2 before 6.6.55; 6.7 before 6.8.7; 6.9; 6.9; +1 more · source: NVD

Linux · Linux

33575df7be6748292f88453f29319af6d639c5c8 before f13b04cf65a86507ff15a9bbf37969d25be3e2a0; 33575df7be6748292f88453f29319af6d639c5c8 before 9d42f373391211c7c8af66a3a316533a32b8a607; 33575df7be6748292f88453f29319af6d639c5c8 before 28234f8ab69c522ba447f3e041bbfbb284c5959a; 33575df7be6748292f88453f29319af6d639c5c8 before 8ee0c132a61df9723813c40e742dc5321824daa9; 33575df7be6748292f88453f29319af6d639c5c8 before 4f3951242ace5efc7131932e2e01e6ac6baed846; 2.6.39 · source: vendor

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens

before V1.1.1 · source: CISA

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-35965

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-35965

Patch