Riskcovery

CVE-2024-36032

Bluetooth: qca: fix info leak when fetching fw build id

State
Published
Severity
8.1 High
Published
May 30, 2024
Updated
Aug 5, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: fix info leak when fetching fw build id

Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HLinux
3.12.3 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 to before 62d5550ab62042dcceaf18844d0feadbb962cffeAffected
  • c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 to before 57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488Affected
  • c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 to before 6b63e0ef4d3ce0080395e5091fba2023f246c45aAffected
  • c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 to before a571044cc0a0c944e7c12237b6768aeedd7480e1Affected
  • c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 to before cda0d6a198e2a7ec6f176c36173a57bdd8af7af2Affected
LinuxLinux
  • 5.12Affected
  • before 5.12Not affected
  • 5.15.162 through 5.15.*Not affected
  • 6.1.91 through 6.1.*Not affected
  • 6.6.31 through 6.6.*Not affected
  • 6.8.10 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.