LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35963: Bluetooth: hci_sock: Fix not validating setsockopt user input

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length before copying data.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user could abuse insufficient input-length validation in the Linux Bluetooth subsystem, potentially exposing sensitive kernel data or crashing the system. The issue does not appear remotely exploitable from the supplied evidence and requires no user interaction.

Executive priority

Prioritize remediation through routine high-severity patching, accelerated for systems accessible to untrusted local users. Immediate emergency isolation is not supported by the evidence because exploitation is local and active exploitation is unconfirmed. Validate vendor backports carefully because upstream version information alone may not reflect distribution patch status.

Technical view

Linux Bluetooth HCI socket option handling copied user-controlled data without first validating its length. The kernel fix adds a length check before copying. CVSS 3.1 is 7.1: local access, low complexity, low privileges, high confidentiality impact, no integrity impact, and high availability impact.

Likely exposure

Exposure is limited to systems running affected Linux kernel builds where a low-privileged local user can reach Bluetooth HCI socket handling. The supplied version data is irregular, so organizations should map their exact kernel package to the referenced stable fixes rather than infer broad version ranges.

Exploitation context

CISA KEV status is false, and the supplied sources do not establish active exploitation or public weaponization. Exploitation requires local access with low privileges; it is not described as a remote Bluetooth attack. Treat claims beyond possible information disclosure and system disruption as unconfirmed.

Researcher notes

The vulnerable operation is in Bluetooth HCI socket setsockopt input handling. The concise upstream description identifies missing length validation before a copy, while the CVSS vector indicates confidentiality and availability consequences. The source bundle provides several stable-branch fixes but no demonstrated exploit, root-cause depth, affected configuration requirements, or reliable universal version range.

Mitigation direction

  • Install a vendor-supported kernel package containing the applicable stable fix.
  • Review Linux distribution security guidance for the exact package and backport status.
  • Prioritize shared, multi-user, and other systems where untrusted local users have accounts.
  • Apply normal change control and reboot if required to activate the updated kernel.

Validation and detection

  • Record the running kernel version and distribution package release on each potentially exposed system.
  • Compare package changelogs or vendor advisories with the referenced upstream stable commits.
  • Confirm the fixed kernel is running after maintenance, not merely installed.
  • Review monitoring for unexplained kernel crashes; absence of crashes does not prove non-exploitation.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35963 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2024-35963Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux09572fca7223bcf32c9f0d5e100d8381a81d55f4, 09572fca7223bcf32c9f0d5e100d8381a81d55f4, 09572fca7223bcf32c9f0d5e100d8381a81d55f4, 09572fca7223bcf32c9f0d5e100d8381a81d55f4unaffected
LinuxLinux5.16, 0, 6.1.113, 6.6.55, 6.8.7, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.