CVE-2024-35965

What it actually does

Failure to validate the length of user-supplied data before copying it in the L2CAP setsockopt handler allows out-of-bounds memory access or use of uninitialized data.

Why it matters to the business

Local attackers on affected Linux systems can potentially read sensitive kernel memory or cause system instability, impacting availability and confidentiality of Bluetooth-enabled devices across the ecosystem.

How an attack unfolds

An attacker with local access crafts a malicious setsockopt call on a Bluetooth L2CAP socket with an invalid length parameter, bypassing input checks and triggering the vulnerability during data copy. Potential exploitation observed in campaigns by espionage and financially motivated actors targeting Linux kernel issues.

How to fix it

Update the Linux kernel to a version containing commit f13b04cf65a86507ff15a9bbf37969d25be3e2a0 or later.

How to confirm the fix worked

Verify the kernel source includes the fix for validating setsockopt user input length in L2CAP; test by attempting setsockopt with invalid lengths and confirm no crash or leak.

Typical attack path

1. Obtain local user access on a Linux system
2. Create or manipulate a Bluetooth L2CAP socket
3. Call setsockopt with crafted parameters exceeding expected length
4. Trigger kernel code path that copies data without validation

How to detect it

Look for unusual setsockopt calls on L2CAP sockets in kernel logs or audit trails; monitor for Bluetooth related crashes potentially linked to exploitation campaigns.

What your security team should do

• Apply the kernel patch immediately
• Monitor for local privilege escalation attempts involving Bluetooth sockets
• Restrict Bluetooth usage if not required