CVE-2024-36880

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36880
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e Patch
https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c Patch
https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d Patch
https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d Patch
https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 Patch
https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e Patch
https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c Patch
https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d Patch
https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d Patch
https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
History

30 Sep 2025, 17:46

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e - () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e - Patch
References () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c - () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c - Patch
References () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d - () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d - Patch
References () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d - () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d - Patch
References () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 - () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:22

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: qca: agregar comprobaciones de integridad del firmware faltantes Agregue las comprobaciones de integridad del firmware faltantes al analizar los archivos de firmware antes de descargarlos para evitar acceder y dañar la memoria más allá del búfer vmalloced.
References () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e - () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e -
References () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c - () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c -
References () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d - () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d -
References () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d - () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d -
References () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 - () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 -

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-09-30 17:46

NVD link : CVE-2024-36880

Mitre link : CVE-2024-36880

CVE.ORG link : CVE-2024-36880

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo