CVE-2024-35967

HighCVSS 7.1/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix not validating setsockopt user input

syzbot reported sco_sock_setsockopt() is copying data without checking user input length.

BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
LinuxLinux>= b96e9c671b05f95126753a22145d4509d45ca197, < b0e30c37695b614bee69187f86eaf250e36606ce; >= b96e9c671b05f95126753a22145d4509d45ca197, < 2c2dc87cdebef3fe3b9d7a711a984c70e376e32e; >= b96e9c671b05f95126753a22145d4509d45ca197, < 7bc65d23ba20dcd7ecc094a12c181e594e5eb315; >= b96e9c671b05f95126753a22145d4509d45ca197, < 72473db90900da970a16ee50ad23c2c38d107d8c; >= b96e9c671b05f95126753a22145d4509d45ca197, < 419a0ffca7010216f0fc265b08558d7394fa0ba7; >= b96e9c671b05f95126753a22145d4509d45ca197, < 51eda36d33e43201e7a4fd35232e069b2c850b01
LinuxLinux3.8
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
May 20, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-359685.5In the Linux kernel, the following vulnerability has been resolved: pds_core: Fix pdsc_check_pci_health function to use work thread When tCVE-2024-359698.8In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr AltCVE-2024-35976.1The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This CVE-2024-359706.3In the Linux kernel, the following vulnerability has been resolved: af_unix: Clear stale u->oob_skb. syzkaller started to report deadlock CVE-2024-359715.5In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang The CVE-2024-359725.5In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() If ulCVE-2024-359735.5In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to CVE-2024-359745.5In the Linux kernel, the following vulnerability has been resolved: block: fix q->blkg_list corruption during disk rebind Multiple gendiskCVE-2024-359755.5In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix transmit scheduler resource leak Inorder to support CVE-2024-359767.1In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING syzbot reCVE-2024-359774.7In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_uart: properly fix race condition The cros_ecCVE-2024-359785.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix memory leak in hci_req_sync_complete() In 'hci_req_sync
CVE-2024-35967: High severity, CVSS 7.1 | Vulnix