High severity · published May 20, 2024
CVE-2024-35966
Bluetooth: RFCOMM: Fix not validating setsockopt user input
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix not validating setsockopt user input
syzbot reported rfcomm_sock_setsockopt_old() is copying data without
checking user input length.
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset
include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr
include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old
net/bluetooth/rfcomm/sock.c:632 [inline]
BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70
net/bluetooth/rfcomm/sock.c:673
Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.30 before 5.10.234; 5.11 before 5.15.178; 5.16 before 6.1.107; 6.2 before 6.6.47; 6.7 before 6.8.7; 6.9; +2 more · source: NVD
LI
Linux · Linux
bb23c0ab824653be4aa7dfca15b07b3059717004 before d072ea24748189cd8f4a9c3f585ca9af073a0838; bb23c0ab824653be4aa7dfca15b07b3059717004 before 00767fbd67af70d7a550caa5b12d9515fa978bab; bb23c0ab824653be4aa7dfca15b07b3059717004 before eea40d33bf936a5c7fb03c190e61e0cfee00e872; bb23c0ab824653be4aa7dfca15b07b3059717004 before 4ea65e2095e9bd151d0469328dd7fc2858feb546; bb23c0ab824653be4aa7dfca15b07b3059717004 before c3f787a3eafe519c93df9abbb0ca5145861c8d0f; bb23c0ab824653be4aa7dfca15b07b3059717004 before a97de7bff13b1cc825c1b1344eaed8d6c2d3e695; +1 more · source: vendor
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35966
Patch
https://git.kernel.org/stable/c/00767fbd67af70d7a550caa5b12d9515fa978bab
Patch
https://git.kernel.org/stable/c/4ea65e2095e9bd151d0469328dd7fc2858feb546
Patch
https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695
Patch
https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f
Patch
https://git.kernel.org/stable/c/d072ea24748189cd8f4a9c3f585ca9af073a0838
Patch
https://git.kernel.org/stable/c/eea40d33bf936a5c7fb03c190e61e0cfee00e872
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability