CVE-2024-26889: Bluetooth: hci_core: Fix possible buffer overflow
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: Fix possible buffer overflow
struct hcidevinfo has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: Fix possible buffer overflow
The Linux kernel CVE team has assigned CVE-2024-26889 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041742-CVE-2024-26889-edfc@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.311 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.273 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.214 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.153 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.83 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.7.12-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 4.19.311 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.4.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.214 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.153 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26889?
CVE-2024-26889 has been categorized as a potential buffer overflow vulnerability in the Linux kernel.
How do I fix CVE-2024-26889?
To fix CVE-2024-26889, ensure your Linux kernel is updated to versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9 or relevant Debian versions.
Which Linux kernel versions are affected by CVE-2024-26889?
CVE-2024-26889 affects multiple kernel versions prior to the mentioned remedial versions across both Red Hat and Debian distributions.
What is the impact of CVE-2024-26889?
The impact of CVE-2024-26889 could lead to potential exploitation through a buffer overflow affecting Bluetooth operations.
Is CVE-2024-26889 related to Bluetooth functionality?
Yes, CVE-2024-26889 pertains specifically to a vulnerability in the Bluetooth stack of the Linux kernel.