{"id":"CVE-2024-35967","revision":"f3709114318f4200b57bb32e12a23f2e","records":[{"revision":"f3709114318f4200b57bb32e12a23f2e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-35967","aliases":[],"title":"Bluetooth: SCO: Fix not validating setsockopt user input","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix not validating setsockopt user input\n\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578","state":0,"publishedAt":"2024-05-20T09:41:56.503+00:00","modifiedAt":"2026-10-15T00:41:48.124+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/bluetooth.h\",\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\",\n                            \"lessThan\": \"b0e30c37695b614bee69187f86eaf250e36606ce\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\",\n                            \"lessThan\": \"2c2dc87cdebef3fe3b9d7a711a984c70e376e32e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\",\n                            \"lessThan\": \"7bc65d23ba20dcd7ecc094a12c181e594e5eb315\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\",\n                            \"lessThan\": \"72473db90900da970a16ee50ad23c2c38d107d8c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\",\n                            \"lessThan\": \"419a0ffca7010216f0fc265b08558d7394fa0ba7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96e9c671b05f95126753a22145d4509d45ca197\",\n                            \"lessThan\": \"51eda36d33e43201e7a4fd35232e069b2c850b01\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/bluetooth.h\",\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.216\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.178\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.87\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.28\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.7\",\n                            \"lessThanOrEqual\": \"6.8.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.9\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ce","https://git.kernel.org/stable/c/2c2dc87cdebef3fe3b9d7a711a984c70e376e32e","https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315","https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8c","https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7","https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-35967","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-35967","identifiers":["CVE-2024-35967"]},"retained":false,"historicalAffected":[]}],"coverage":[]}