CVE-2024-53144

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

Severity Score

7.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4
("Bluetooth: Always request for user confirmation for Just Works")
always request user confirmation with confirm_hint set since the
likes of bluetoothd have dedicated policy around JUST_WORKS method
(e.g. main.conf:JustWorksRepairing). CVE: CVE-2024-8805

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just Works") always request user confirmation with confirm_hint set since the likes of bluetoothd have dedicated policy around JUST_WORKS method (e.g. main.conf:JustWorksRepairing). CVE: CVE-2024-8805

Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service or possibly execute arbitrary code.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-11-19 CVE Reserved
2024-12-17 CVE Published
2024-12-19 CVE Updated
2025-03-29 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (13)

URL	Tag	Source
https://git.kernel.org/stable/c/ba15a58b179ed76a7e887177f2b06de12c58ec8f	Vuln. Introduced
https://git.kernel.org/stable/c/373d1dfcffc63c68184419264a7eaed422c7958e	Vuln. Introduced
https://git.kernel.org/stable/c/bc96ff59b2f19e924d9e15e24cee19723d674b92	Vuln. Introduced
https://git.kernel.org/stable/c/6ab84785311dc4d0348e6bd4e1c491293b770b98	Vuln. Introduced
https://git.kernel.org/stable/c/778763287ded64dd5c022435d3e0e3182f148a64	Vuln. Introduced
https://git.kernel.org/stable/c/9a5fcacabde0fe11456f4a1e88072c01846cea25	Vuln. Introduced
https://git.kernel.org/stable/c/039da39a616103ec7ab8ac351bfb317854e5507c	Vuln. Introduced
https://www.zerodayinitiative.com/advisories/ZDI-24-1229

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/d17c631ba04e960eb6f8728b10d585de20ac4f71	2024-10-17
https://git.kernel.org/stable/c/830c03e58beb70b99349760f822e505ecb4eeb7e	2024-10-10
https://git.kernel.org/stable/c/ad7adfb95f64a761e4784381e47bee1a362eb30d	2024-10-10
https://git.kernel.org/stable/c/5291ff856d2c5177b4fe9c18828312be30213193	2024-10-10
https://git.kernel.org/stable/c/b25e11f978b63cb7857890edb3a698599cddb10e	2024-09-27

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.16 < 6.1.113 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.1.113"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.16 < 6.6.55 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.6.55"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.16 < 6.10.14 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.10.14"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.16 < 6.11.3 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.11.3"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.16 < 6.12 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.16 < 6.12"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.2.61 Search vendor "Linux" for product "Linux Kernel" and version "3.2.61"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.4.98 Search vendor "Linux" for product "Linux Kernel" and version "3.4.98"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.10.48 Search vendor "Linux" for product "Linux Kernel" and version "3.10.48"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.12.25 Search vendor "Linux" for product "Linux Kernel" and version "3.12.25"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14.12 Search vendor "Linux" for product "Linux Kernel" and version "3.14.12"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.15.5 Search vendor "Linux" for product "Linux Kernel" and version "3.15.5"		en		Affected