CVE-2024-35966

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35966
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/00767fbd67af70d7a550caa5b12d9515fa978bab Patch
https://git.kernel.org/stable/c/4ea65e2095e9bd151d0469328dd7fc2858feb546 Patch
https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 Patch
https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f Patch
https://git.kernel.org/stable/c/d072ea24748189cd8f4a9c3f585ca9af073a0838 Patch
https://git.kernel.org/stable/c/eea40d33bf936a5c7fb03c190e61e0cfee00e872 Patch
https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 Patch
https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
History

23 Sep 2025, 18:00

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/00767fbd67af70d7a550caa5b12d9515fa978bab - () https://git.kernel.org/stable/c/00767fbd67af70d7a550caa5b12d9515fa978bab - Patch
References () https://git.kernel.org/stable/c/4ea65e2095e9bd151d0469328dd7fc2858feb546 - () https://git.kernel.org/stable/c/4ea65e2095e9bd151d0469328dd7fc2858feb546 - Patch
References () https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 - () https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 - Patch
References () https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f - () https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f - Patch
References () https://git.kernel.org/stable/c/d072ea24748189cd8f4a9c3f585ca9af073a0838 - () https://git.kernel.org/stable/c/d072ea24748189cd8f4a9c3f585ca9af073a0838 - Patch
References () https://git.kernel.org/stable/c/eea40d33bf936a5c7fb03c190e61e0cfee00e872 - () https://git.kernel.org/stable/c/eea40d33bf936a5c7fb03c190e61e0cfee00e872 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux
Linux linux Kernel
CWE CWE-125

02 Feb 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/00767fbd67af70d7a550caa5b12d9515fa978bab -
  • () https://git.kernel.org/stable/c/d072ea24748189cd8f4a9c3f585ca9af073a0838 -

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 - () https://git.kernel.org/stable/c/a97de7bff13b1cc825c1b1344eaed8d6c2d3e695 -
References () https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f - () https://git.kernel.org/stable/c/c3f787a3eafe519c93df9abbb0ca5145861c8d0f -

29 Aug 2024, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/eea40d33bf936a5c7fb03c190e61e0cfee00e872 -

19 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/4ea65e2095e9bd151d0469328dd7fc2858feb546 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: RFCOMM: solución al no validar la entrada del usuario de setsockopt. Syzbot informó que rfcomm_sock_setsockopt_old() está copiando datos sin verificar la longitud de la entrada del usuario. BUG: KASAN: slab fuera de los límites en copy_from_sockptr_offset include/linux/sockptr.h:49 [en línea] BUG: KASAN: slab fuera de los límites en copy_from_sockptr include/linux/sockptr.h:55 [en línea] ERROR: KASAN: losa fuera de los límites en rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [en línea] BUG: KASAN: losa fuera de los límites en rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/ sock.c:673 Lectura de tamaño 4 en addr ffff8880209a8bc3 por tarea syz-executor632/5064

20 May 2024, 13:00

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-20 10:15

Updated : 2025-09-23 18:00

NVD link : CVE-2024-35966

Mitre link : CVE-2024-35966

CVE.ORG link : CVE-2024-35966

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read