CVE-2024-35967

HIGH

Linux Kernel 3.8-5.10.216 5.11-5.15.178 5.16-6.1.87 6.2-6.6.28 6.7-6.8.7 - Out-of-bounds Read in sco_sock_setsockopt

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578

References (8)

Core 8

Scores

CVSS v3 7.1
EPSS 0.0024
EPSS Percentile 14.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-125
Status published
Products (22)
debian/debian_linux 10.0
linux/Kernel 3.8.0 - 5.10.216linux
linux/Kernel 5.11.0 - 5.15.178linux
linux/Kernel 5.16.0 - 6.1.87linux
linux/Kernel 6.2.0 - 6.6.28linux
linux/Kernel 6.7.0 - 6.8.7linux
Linux/Linux < 3.8
Linux/Linux 3.8
Linux/Linux 5.10.216 - 5.10.*
Linux/Linux 5.15.178 - 5.15.*
... and 12 more
Published May 20, 2024
Tracked Since Feb 18, 2026