VYPR
← All advisories
High severity7.1NVD Advisory· Published May 20, 2024· Updated May 12, 2026

CVE-2024-35967

CVE-2024-35967

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix not validating setsockopt user input

syzbot reported sco_sock_setsockopt() is copying data without checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing validation of user input length in the Bluetooth SCO socket setsockopt can lead to a slab out-of-bounds read, causing information disclosure or system crash.

Root

Cause

The vulnerability resides in the sco_sock_setsockopt() function in net/bluetooth/sco.c (Linux kernel). The function copies data from user space via copy_from_sockptr() without verifying the length of the input, allowing a slab-out-of-bounds read [1][2][3].

Exploitation

An attacker with local access to the system and the ability to open a Bluetooth SCO socket can trigger the bug by passing a crafted buffer with an invalid length to setsockopt(). No special privileges beyond the ability to create a SCO socket are required. The syzbot fuzzer demonstrated the issue by reproducing the out-of-bounds access.

Impact

Successful exploitation can cause a kernel panic (denial of service) or leak sensitive kernel memory, potentially aiding further attacks. The CVSS v3 score is 7.1 (High), reflecting the potential for confidentiality and availability impact.

Mitigation

The fix has been included in stable Linux kernel updates and is referenced in commits [2][3][4]. Siemens advisory SSA-265688 lists this CVE as affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, which should be updated to a patched kernel version [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

119

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.