GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35967 (GCVE-0-2024-35967)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:41 – Updated: 2026-08-05 11:31
VLAI
Title
Bluetooth: SCO: Fix not validating setsockopt user input
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 17:01 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b96e9c671b05f95126753a22145d4509d45ca197 , < b0e30c37695b614bee69187f86eaf250e36606ce (git)
Affected: b96e9c671b05f95126753a22145d4509d45ca197 , < 2c2dc87cdebef3fe3b9d7a711a984c70e376e32e (git)
Affected: b96e9c671b05f95126753a22145d4509d45ca197 , < 7bc65d23ba20dcd7ecc094a12c181e594e5eb315 (git)
Affected: b96e9c671b05f95126753a22145d4509d45ca197 , < 72473db90900da970a16ee50ad23c2c38d107d8c (git)
Affected: b96e9c671b05f95126753a22145d4509d45ca197 , < 419a0ffca7010216f0fc265b08558d7394fa0ba7 (git)
Affected: b96e9c671b05f95126753a22145d4509d45ca197 , < 51eda36d33e43201e7a4fd35232e069b2c850b01 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 5.10.216 , ≤ 5.10.* (semver)
Unaffected: 5.15.178 , ≤ 5.15.* (semver)
Unaffected: 6.1.87 , ≤ 6.1.* (semver)
Unaffected: 6.6.28 , ≤ 6.6.* (semver)
Unaffected: 6.8.7 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:01:27.722344Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:26.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.126Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:53:18.152Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/bluetooth.h",
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0e30c37695b614bee69187f86eaf250e36606ce",
              "status": "affected",
              "version": "b96e9c671b05f95126753a22145d4509d45ca197",
              "versionType": "git"
            },
            {
              "lessThan": "2c2dc87cdebef3fe3b9d7a711a984c70e376e32e",
              "status": "affected",
              "version": "b96e9c671b05f95126753a22145d4509d45ca197",
              "versionType": "git"
            },
            {
              "lessThan": "7bc65d23ba20dcd7ecc094a12c181e594e5eb315",
              "status": "affected",
              "version": "b96e9c671b05f95126753a22145d4509d45ca197",
              "versionType": "git"
            },
            {
              "lessThan": "72473db90900da970a16ee50ad23c2c38d107d8c",
              "status": "affected",
              "version": "b96e9c671b05f95126753a22145d4509d45ca197",
              "versionType": "git"
            },
            {
              "lessThan": "419a0ffca7010216f0fc265b08558d7394fa0ba7",
              "status": "affected",
              "version": "b96e9c671b05f95126753a22145d4509d45ca197",
              "versionType": "git"
            },
            {
              "lessThan": "51eda36d33e43201e7a4fd35232e069b2c850b01",
              "status": "affected",
              "version": "b96e9c671b05f95126753a22145d4509d45ca197",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/bluetooth.h",
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.178",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.87",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.28",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.7",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix not validating setsockopt user input\n\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is triggered purely through the setsockopt(2) syscall on a locally created AF_BLUETOOTH/BTPROTO_SCO socket; no Bluetooth radio traffic, paired peer, or adapter link is involved in reaching the unvalidated copy.\nAC:L - Exploitation is fully deterministic and attacker-controlled \u2014 issue setsockopt(fd, SOL_BLUETOOTH, BT_PKT_STATUS/BT_DEFER_SETUP, buf, optlen\u003c4); no race, no timing window, and no memory-layout condition outside the attacker\u0027s influence.\nPR:L - sco_sock_create() and bt_sock_create() contain no capability check (unlike HCI raw sockets), so any unprivileged local user can open a SCO socket and call setsockopt; only the permissive security_socket_setsockopt() LSM hook sits on the path.\nUI:N - The attacker performs every step itself via its own socket; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds access occurs in kernel slab memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The bug is an out-of-bounds read of kernel heap memory past the end of the optval allocation, and the disclosed value is observable back in userspace because sco_sock_getsockopt() returns the BT_SK_DEFER_SETUP/BT_SK_PKT_STATUS bits, giving a repeatable oracle over adjacent kernel memory that can be combined with heap grooming to leak kernel data.\nI:N - The defect is a read past the end of a buffer; nothing is written out of bounds, and the leaked value only toggles a flag on the attacker\u0027s own socket, so no data outside the attacker\u0027s authority is modified.\nA:H - The slab out-of-bounds read triggers a KASAN BUG/panic on hardened and debug kernels and can fault when the copy crosses into an unmapped or guarded page, producing a kernel oops repeatable at will by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:16.372Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c2dc87cdebef3fe3b9d7a711a984c70e376e32e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315"
        },
        {
          "url": "https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7"
        },
        {
          "url": "https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01"
        }
      ],
      "title": "Bluetooth: SCO: Fix not validating setsockopt user input",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35967",
    "datePublished": "2024-05-20T09:41:56.503Z",
    "dateReserved": "2024-05-17T13:50:33.140Z",
    "dateUpdated": "2026-08-05T11:31:16.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35967",
      "date": "2026-09-16",
      "epss": "0.00239",
      "percentile": "0.15137"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: Fix not validating setsockopt user input\\n\\nsyzbot reported sco_sock_setsockopt() is copying data without\\nchecking user input length.\\n\\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\\ninclude/linux/sockptr.h:49 [inline]\\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\\ninclude/linux/sockptr.h:55 [inline]\\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\\nnet/bluetooth/sco.c:893\\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: Bluetooth: SCO: la soluci\\u00f3n no valida la entrada del usuario de setsockopt. syzbot inform\\u00f3 que sco_sock_setsockopt() est\\u00e1 copiando datos sin verificar la longitud de la entrada del usuario. BUG: KASAN: slab fuera de los l\\u00edmites en copy_from_sockptr_offset include/linux/sockptr.h:49 [en l\\u00ednea] BUG: KASAN: slab fuera de los l\\u00edmites en copy_from_sockptr include/linux/sockptr.h:55 [en l\\u00ednea] BUG: KASAN: slab fuera de los l\\u00edmites en sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Lectura de tama\\u00f1o 4 en la direcci\\u00f3n ffff88805f7b15a3 mediante la tarea syz-executor.5/12578\"}]",
      "id": "CVE-2024-35967",
      "lastModified": "2024-11-21T09:21:19.020",
      "published": "2024-05-20T10:15:11.647",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35967\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:11.647\",\"lastModified\":\"2026-08-04T11:18:16.300\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: Fix not validating setsockopt user input\\n\\nsyzbot reported sco_sock_setsockopt() is copying data without\\nchecking user input length.\\n\\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\\ninclude/linux/sockptr.h:49 [inline]\\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\\ninclude/linux/sockptr.h:55 [inline]\\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\\nnet/bluetooth/sco.c:893\\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Bluetooth: SCO: la soluci\u00f3n no valida la entrada del usuario de setsockopt. syzbot inform\u00f3 que sco_sock_setsockopt() est\u00e1 copiando datos sin verificar la longitud de la entrada del usuario. BUG: KASAN: slab fuera de los l\u00edmites en copy_from_sockptr_offset include/linux/sockptr.h:49 [en l\u00ednea] BUG: KASAN: slab fuera de los l\u00edmites en copy_from_sockptr include/linux/sockptr.h:55 [en l\u00ednea] BUG: KASAN: slab fuera de los l\u00edmites en sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff88805f7b15a3 mediante la tarea syz-executor.5/12578\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/bluetooth/bluetooth.h\",\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b96e9c671b05f95126753a22145d4509d45ca197\",\"lessThan\":\"b0e30c37695b614bee69187f86eaf250e36606ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b96e9c671b05f95126753a22145d4509d45ca197\",\"lessThan\":\"2c2dc87cdebef3fe3b9d7a711a984c70e376e32e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b96e9c671b05f95126753a22145d4509d45ca197\",\"lessThan\":\"7bc65d23ba20dcd7ecc094a12c181e594e5eb315\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b96e9c671b05f95126753a22145d4509d45ca197\",\"lessThan\":\"72473db90900da970a16ee50ad23c2c38d107d8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b96e9c671b05f95126753a22145d4509d45ca197\",\"lessThan\":\"419a0ffca7010216f0fc265b08558d7394fa0ba7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b96e9c671b05f95126753a22145d4509d45ca197\",\"lessThan\":\"51eda36d33e43201e7a4fd35232e069b2c850b01\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/bluetooth/bluetooth.h\",\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.216\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.178\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.87\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.28\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.7\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T17:01:27.722344Z\",\"id\":\"CVE-2024-35967\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.8\",\"versionEndExcluding\":\"5.10.216\",\"matchCriteriaId\":\"755D01D7-CA99-4A43-8D82-05B255C87D3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.178\",\"matchCriteriaId\":\"171159A1-9827-4C7B-821D-55398B837C49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.87\",\"matchCriteriaId\":\"BDA59296-EDB8-44CD-98E4-C08C051569E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.28\",\"matchCriteriaId\":\"8D6315B0-B3BA-406C-B0DB-51D9A63753F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.7\",\"matchCriteriaId\":\"531BDFB5-EF6A-4707-902E-146368303499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2c2dc87cdebef3fe3b9d7a711a984c70e376e32e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:58:43+00:00",
      "cve": "CVE-2024-35967",
      "id": "CVE-2024-35967",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: SCO: Fix not validating setsockopt user input",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35967.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T17:01:38Z",
      "cve": "CVE-2024-35967",
      "id": "CVE-2024-35967",
      "initial_release_date": "2024-05-21T01:58:43Z",
      "product_status:known_affected": "577",
      "product_status:known_not_affected": "12",
      "product_status:recommended": "797",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35967",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35967.json",
      "version": "100"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.126Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:53:18.152Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35967\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T17:01:27.722344Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.992Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Bluetooth: SCO: Fix not validating setsockopt user input\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The flaw is triggered purely through the setsockopt(2) syscall on a locally created AF_BLUETOOTH/BTPROTO_SCO socket; no Bluetooth radio traffic, paired peer, or adapter link is involved in reaching the unvalidated copy.\\nAC:L - Exploitation is fully deterministic and attacker-controlled \\u2014 issue setsockopt(fd, SOL_BLUETOOTH, BT_PKT_STATUS/BT_DEFER_SETUP, buf, optlen\u003c4); no race, no timing window, and no memory-layout condition outside the attacker\u0027s influence.\\nPR:L - sco_sock_create() and bt_sock_create() contain no capability check (unlike HCI raw sockets), so any unprivileged local user can open a SCO socket and call setsockopt; only the permissive security_socket_setsockopt() LSM hook sits on the path.\\nUI:N - The attacker performs every step itself via its own socket; no victim action, mount, or file open is needed.\\nS:U - The out-of-bounds access occurs in kernel slab memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The bug is an out-of-bounds read of kernel heap memory past the end of the optval allocation, and the disclosed value is observable back in userspace because sco_sock_getsockopt() returns the BT_SK_DEFER_SETUP/BT_SK_PKT_STATUS bits, giving a repeatable oracle over adjacent kernel memory that can be combined with heap grooming to leak kernel data.\\nI:N - The defect is a read past the end of a buffer; nothing is written out of bounds, and the leaked value only toggles a flag on the attacker\u0027s own socket, so no data outside the attacker\u0027s authority is modified.\\nA:H - The slab out-of-bounds read triggers a KASAN BUG/panic on hardened and debug kernels and can fault when the copy crosses into an unmapped or guarded page, producing a kernel oops repeatable at will by an unprivileged user.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\", \"lessThan\": \"b0e30c37695b614bee69187f86eaf250e36606ce\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\", \"lessThan\": \"2c2dc87cdebef3fe3b9d7a711a984c70e376e32e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\", \"lessThan\": \"7bc65d23ba20dcd7ecc094a12c181e594e5eb315\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\", \"lessThan\": \"72473db90900da970a16ee50ad23c2c38d107d8c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\", \"lessThan\": \"419a0ffca7010216f0fc265b08558d7394fa0ba7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\", \"lessThan\": \"51eda36d33e43201e7a4fd35232e069b2c850b01\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/bluetooth/bluetooth.h\", \"net/bluetooth/sco.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.178\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.87\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.28\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/bluetooth/bluetooth.h\", \"net/bluetooth/sco.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce\"}, {\"url\": \"https://git.kernel.org/stable/c/2c2dc87cdebef3fe3b9d7a711a984c70e376e32e\"}, {\"url\": \"https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315\"}, {\"url\": \"https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c\"}, {\"url\": \"https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7\"}, {\"url\": \"https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: Fix not validating setsockopt user input\\n\\nsyzbot reported sco_sock_setsockopt() is copying data without\\nchecking user input length.\\n\\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\\ninclude/linux/sockptr.h:49 [inline]\\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\\ninclude/linux/sockptr.h:55 [inline]\\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\\nnet/bluetooth/sco.c:893\\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.216\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.178\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.87\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.28\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.7\", \"versionStartIncluding\": \"3.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:16.372Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35967\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:16.372Z\", \"dateReserved\": \"2024-05-17T13:50:33.140Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:41:56.503Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.