Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s Bluetooth SCO socket handling can let a locally authenticated, low-privilege user make the kernel read beyond an allocated buffer. This may expose sensitive kernel memory or crash the system. It does not appear remotely exploitable from the supplied evidence.
Executive priority
Prioritize remediation on multi-user Linux hosts, appliances, and endpoints where untrusted local accounts coexist with enabled Bluetooth. This is high severity but not an internet-scale emergency: exploitation requires local privileges, and the supplied sources do not show active attacks. Use the normal expedited kernel-patching process and ensure systems reboot into the corrected kernel.
Technical view
sco_sock_setsockopt() copied a four-byte option value without first confirming that the supplied input length was sufficient. The resulting out-of-bounds slab read was detected by KASAN in copy_from_sockptr. CVSS 3.1 rates it 7.1: local access, low complexity, low privileges, no user interaction, with high confidentiality and availability impact.
Likely exposure
Exposure applies to Linux systems running affected kernels where an untrusted local user can reach Bluetooth SCO socket functionality. The supplied version data identifies affected Linux releases from 3.8 and fixed stable releases including 5.10.216, 5.15.178, 6.1.87, 6.6.28, and 6.8.7; confirm distribution backports.
Exploitation context
The CVSS vector requires local access and low privileges. The source bundle reports a syzbot/KASAN-triggered out-of-bounds read, but provides no evidence of real-world exploitation. The CVE is not listed as CISA KEV in the supplied data. Treat information disclosure and system crashes as credible impacts; reliable code execution is not established.
Researcher notes
The demonstrated condition is a four-byte slab out-of-bounds read caused by inadequate setsockopt length validation in net/bluetooth/sco.c. Multiple stable-branch commits are supplied, indicating branch-specific backports. Assess exposure using distribution patches and kernel configuration, not upstream version strings alone. The evidence supports potential disclosure and denial of service, but not integrity impact or proven privilege escalation.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable stable fix or distribution backport.
- Check Linux distribution and appliance-vendor advisories for the precise fixed package version.
- Where upgrades are delayed, restrict untrusted local access and disable unnecessary Bluetooth functionality after compatibility review.
- Prioritize shared systems where low-privilege users can access Bluetooth SCO sockets.
Validation and detection
- Record each system’s running kernel version, distribution package revision, and reboot state.
- Compare installed packages with vendor advisories; version numbers alone may miss backported fixes.
- Confirm the applicable stable commit or equivalent patch exists in the deployed kernel source package.
- Verify upgraded systems booted into the fixed kernel rather than retaining an older running kernel.
- Review local crash and kernel-sanitizer telemetry for SCO or copy_from_sockptr out-of-bounds events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b0e30c37695b614bee69187f86eaf250e36606ceCVE reference, Linux
- https://git.kernel.org/stable/c/2c2dc87cdebef3fe3b9d7a711a984c70e376e32eCVE reference, Linux
- https://git.kernel.org/stable/c/7bc65d23ba20dcd7ecc094a12c181e594e5eb315CVE reference, Linux
- https://git.kernel.org/stable/c/72473db90900da970a16ee50ad23c2c38d107d8cCVE reference, Linux
- https://git.kernel.org/stable/c/419a0ffca7010216f0fc265b08558d7394fa0ba7CVE reference, Linux
- https://git.kernel.org/stable/c/51eda36d33e43201e7a4fd35232e069b2c850b01CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.