CVE-2024-35967

What it actually does

Out-of-bounds read in sco_sock_setsockopt due to missing validation of user-supplied length before copy_from_sockptr, allowing slab memory disclosure.

Why it matters to the business

Local attackers on affected Linux systems can leak kernel memory or trigger crashes, increasing risk of privilege escalation on servers, desktops, and Android devices using Bluetooth SCO sockets; urgency is moderate given low EPSS and no KEV listing despite the 2024 disclosure.

How an attack unfolds

An attacker with local user privileges creates an SCO Bluetooth socket and invokes setsockopt with a crafted option and oversized or malformed length, bypassing input checks and causing the kernel to read beyond allocated slab memory.

How to fix it

Upgrade the Linux kernel to commit b0e30c37695b614bee69187f86eaf250e36606ce or later stable release containing the fix; rebuild and reboot systems using the updated kernel image.

How to confirm the fix worked

Confirm the running kernel contains commit b0e30c37695b614bee69187f86eaf250e36606ce via git log or uname; recompile a test program exercising sco_sock_setsockopt with oversized input and verify absence of KASAN reports.

Typical attack path

1. Obtain local shell or user context on target Linux system
2. Create AF_BLUETOOTH socket with type SOCK_SEQPACKET and protocol BTPROTO_SCO
3. Prepare malformed setsockopt buffer and length value
4. Call setsockopt to trigger copy_from_sockptr without bounds check
5. Observe resulting KASAN report, kernel oops, or extract disclosed slab data

How to detect it

Review kernel logs for KASAN slab-out-of-bounds reports referencing sco_sock_setsockopt or copy_from_sockptr; inspect audit logs for unusual setsockopt calls on Bluetooth sockets by non-root processes.

What your security team should do

• Prioritize kernel updates on multi-user and Bluetooth-enabled hosts within standard patching windows
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Restrict untrusted local users from Bluetooth socket operations via LSM policies where feasible