CVE-2024-35963

What it actually does

Missing length validation on user-supplied data passed to setsockopt for HCI sockets allows uncontrolled copy of attacker-controlled bytes into kernel memory.

Why it matters to the business

Linux systems using Bluetooth can experience kernel crashes, memory corruption, or local privilege escalation, disrupting operations and requiring urgent patching across fleets of servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access crafts a setsockopt call on an HCI socket supplying an oversized or malformed buffer; because the kernel did not verify the length before copying the data, the copy overruns or underflows kernel structures, enabling memory corruption that can be turned into code execution or denial of service. Publicly discussed Linux kernel flaws have been leveraged by espionage and financially motivated actors in 2024 campaigns.

How to fix it

Update the Linux kernel to a version containing commit 781f3a97a38a338bc893b6db7f9f9670bf1a9e37 or later; rebuild and deploy the fixed kernel across all affected distributions and embedded images.

How to confirm the fix worked

Confirm the running kernel contains commit 781f3a97a38a338bc893b6db7f9f9670bf1a9e37 by inspecting /proc/version or kernel build logs; test that setsockopt calls with invalid lengths are now rejected before the copy occurs.

Typical attack path

1. Obtain local user access on a Linux host with Bluetooth support
2. Open an HCI socket via socket(AF_BLUETOOTH, ...)
3. Prepare a malicious option buffer whose length exceeds the expected structure size
4. Invoke setsockopt without triggering the missing length check
5. Trigger the copy operation to corrupt adjacent kernel memory
6. Escalate privileges or crash the system via the resulting corruption

How to detect it

Review kernel logs for HCI socket-related oops or warnings around setsockopt calls; inspect audit logs for unusual socket option activity on Bluetooth devices; correlate with process execution of tools that directly invoke raw HCI socket operations.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-user Linux systems within the next patch cycle
• Disable Bluetooth kernel modules where the feature is unnecessary
• Monitor vendor advisories for backported fixes in LTS kernels
• Add kernel update automation and reboot orchestration to reduce exposure window