Junglewise Threat Intelligence

CVE-2024-35965: Linux Kernel Bluetooth L2CAP improper input validation in setsockopt

CVE-2024-35965 · Severity: high · CVSS 7.1 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem. This flaw could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue stems from how the system handles configuration requests for Bluetooth connections, specifically failing to verify the size of data provided by a user before processing it.

Technical details

A vulnerability exists in the L2CAP component of the Linux kernel Bluetooth stack (net/bluetooth/l2cap_sock.c). The functions l2cap_sock_setsockopt and l2cap_sock_setsockopt_old failed to properly validate the 'optlen' parameter before copying data from user space using copy_from_sockptr. This improper validation of specified quantity in input (CWE-1284) allows a local attacker with low privileges to trigger an out-of-bounds read or kernel memory corruption. The fix replaces direct copy calls with bt_copy_from_sockptr, which enforces strict length checks against the expected structure size. Patches have been backported to multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.39 to 5.10.227, 5.11 to 6.1.87, 6.2 to 6.6.55, 6.7 to 6.8.7, 6.9-rc1 to 6.9-rc3

Timeline

  • 2024-05-20: advisory: NVD published the vulnerability record.
  • 2024-04-10: patched: Initial patch committed to the Linux kernel tree.

References

Related threats