CVE-2024-35967: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's Bluetooth subsystem, specifically within the SCO (Synchronous Connection-Oriented) socket implementation. The vulnerability (CVE-2024-35967) was identified when syzbot reported that the sco_sock_setsockopt() function was copying data without properly validating user input length, leading to a slab-out-of-bounds condition (Kernel Git).

The vulnerability manifests as a KASAN (Kernel Address Sanitizer) slab-out-of-bounds error in the copy_from_sockptr_offset and copy_from_sockptr functions, specifically at include/linux/sockptr.h:49 and include/linux/sockptr.h:55. The issue occurs in sco_sock_setsockopt+0xc0b/0xf90 at net/bluetooth/sco.c:893, where a read of size 4 at address ffff88805f7b15a3 is performed without proper bounds checking (Kernel Git).

The vulnerability affects multiple versions of the Linux kernel's Bluetooth subsystem and could potentially lead to memory corruption, system crashes, or potential privilege escalation through the exploitation of the slab-out-of-bounds condition (Ubuntu Security).

The vulnerability was discovered through automated testing by syzbot, indicating it can be triggered through specific socket operations. While there are no reports of active exploitation in the wild, the vulnerability affects multiple kernel versions and could be exploited by a local attacker with access to Bluetooth functionality (Kernel Git).

The issue has been fixed through a patch that implements proper input validation using a new bt_copy_from_sockptr function. This fix has been backported to multiple kernel versions and is available in updated kernel packages for various distributions. Users should update their systems to the patched versions (Ubuntu Security, Kernel Git).