CVE-2024-36880: Bluetooth: qca: add missing firmware sanity checks
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: qca: add missing firmware sanity checks
Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: qca: add missing firmware sanity checks
The Linux kernel CVE team has assigned CVE-2024-36880 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024053031-CVE-2024-36880-c961@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.159 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.91 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.31 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.10 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36880?
CVE-2024-36880 is classified as a medium severity vulnerability due to its potential for memory corruption.
How do I fix CVE-2024-36880?
To fix CVE-2024-36880, update the Linux kernel to version 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-36880?
CVE-2024-36880 affects Linux kernel versions up to 5.10.226-1.
What component is impacted by CVE-2024-36880?
CVE-2024-36880 impacts the Bluetooth component within the Linux kernel.
What are the consequences of not addressing CVE-2024-36880?
Failing to address CVE-2024-36880 could lead to memory corruption and potential system instability.