CVE-2024-35965: Bluetooth: L2CAP: Fix not validating setsockopt user input
Bluetooth: L2CAP: Fix not validating setsockopt user input
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.87 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.90-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35965?
CVE-2024-35965 is categorized with a medium severity due to the potential for user input validation issues in the Linux kernel's Bluetooth functionality.
How do I fix CVE-2024-35965?
To fix CVE-2024-35965, update the Linux kernel to versions 6.1.123-1, 6.1.128-1, or 6.12.12-1 depending on your distribution.
What systems are affected by CVE-2024-35965?
CVE-2024-35965 affects Linux kernel versions up to 5.10.226-1, particularly those using Bluetooth L2CAP.
What is the nature of the vulnerability in CVE-2024-35965?
CVE-2024-35965 is due to the lack of validation of user input length in the Bluetooth L2CAP implementation.
Are there any workarounds for CVE-2024-35965?
No specific workarounds are recommended for CVE-2024-35965; upgrading the kernel is the advised course of action.