Junglewise Threat Intelligence

CVE-2024-35966: Linux Kernel out-of-bounds read in Bluetooth RFCOMM setsockopt

CVE-2024-35966 · Severity: high · CVSS 7.1 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Bluetooth component that could allow a local user to crash the system or potentially access sensitive information. The issue occurs when the system fails to properly check the size of data provided by a user when configuring Bluetooth socket options. This could lead to system instability or unauthorized data access on affected Linux-based devices.

Technical details

An out-of-bounds read vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation (net/bluetooth/rfcomm/sock.c). The functions rfcomm_sock_setsockopt_old() and rfcomm_sock_setsockopt() fail to validate the 'optlen' parameter before copying data from user space using copy_from_sockptr(). A local attacker with the ability to create Bluetooth sockets can provide a length value that exceeds the actual buffer size, leading to a slab-out-of-bounds read. This can result in a kernel crash (denial of service) or the leakage of sensitive kernel memory. The issue has been addressed by replacing direct copy calls with bt_copy_from_sockptr(), which enforces proper length validation.

Affected products

  • Linux Linux Kernel 2.6.30 to 5.10.234, 5.11 to 5.15.178, 5.16 to 6.1.107, 6.2 to 6.6.47, 6.7 to 6.8.7, 6.9-rc1 to 6.9-rc3

Timeline

  • 2024-04-05: patched: Initial patch authored by Luiz Augusto von Dentz
  • 2024-05-20: advisory: CVE-2024-35966 published

References

Related threats