Riskcovery

CVE-2024-35967

Bluetooth: SCO: Fix not validating setsockopt user input

State
Published
Severity
7.1 High
Published
May 20, 2024
Updated
Oct 15, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix not validating setsockopt user input

syzbot reported sco_sock_setsockopt() is copying data without checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b96e9c671b05f95126753a22145d4509d45ca197 to before b0e30c37695b614bee69187f86eaf250e36606ceAffected
  • b96e9c671b05f95126753a22145d4509d45ca197 to before 2c2dc87cdebef3fe3b9d7a711a984c70e376e32eAffected
  • b96e9c671b05f95126753a22145d4509d45ca197 to before 7bc65d23ba20dcd7ecc094a12c181e594e5eb315Affected
  • b96e9c671b05f95126753a22145d4509d45ca197 to before 72473db90900da970a16ee50ad23c2c38d107d8cAffected
  • b96e9c671b05f95126753a22145d4509d45ca197 to before 419a0ffca7010216f0fc265b08558d7394fa0ba7Affected
  • b96e9c671b05f95126753a22145d4509d45ca197 to before 51eda36d33e43201e7a4fd35232e069b2c850b01Affected
LinuxLinux
  • 3.8Affected
  • before 3.8Not affected
  • 5.10.216 through 5.10.*Not affected
  • 5.15.178 through 5.15.*Not affected
  • 6.1.87 through 6.1.*Not affected
  • 6.6.28 through 6.6.*Not affected
  • 6.8.7 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.