CVE-2024-35967

This CVE pertains to a vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the SCO (Synchronous Connection-Oriented) protocol. The issue arises from the sco_sock_setsockopt() function, which copies data without properly validating the length of user input. This oversight can lead to a slab-out-of-bounds read, potentially causing system instability or crashes.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local unprivileged user execution to manipulate socket parameters, restricting the blast radius primarily to a kernel denial of service or out-of-bounds memory read rather than arbitrary code execution. Typical enterprise server installations do not utilize Bluetooth hardware or audio services, significantly reducing exposure under standard configurations. Consequently, systems without active Bluetooth devices or those running headless deployments are largely insulated from practical exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.