VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2024/27xxx/CVE-2024-27416.json
T

430 lines
21 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"cveMetadata": {
"cveId": "CVE-2024-27416",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2024-02-25T13:47:42.682Z",
"datePublished": "2024-05-17T11:51:04.270Z",
"dateUpdated": "2026-08-05T11:29:45.374Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T11:29:45.374Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST\n\nIf we received HCI_EV_IO_CAPA_REQUEST while\nHCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote\ndoes support SSP since otherwise this event shouldn't be generated."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handler processes HCI events generated by a BR/EDR peer that initiates Secure Simple Pairing over an ACL link, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring convention Bluetooth is Adjacent.\nAC:L - The attacker controls its own controller's LMP timing and simply starts SSP immediately upon connection-complete, which reliably beats the host's extra Read Remote Extended Features HCI command plus LMP round trip; the attempt can also be repeated without limit.\nPR:N - HCI_EV_IO_CAPA_REQUEST and HCI_EV_SIMPLE_PAIR_COMPLETE are handled during the pre-bonding pairing phase, before any credentials or link key exist, and the guard is hit before even the HCI_MGMT/HCI_BONDABLE policy checks. No privileges on the target are required.\nUI:N - Reaching the code needs only an ACL connection to a connectable or accept-listed host, which is the default steady state for embedded, automotive, audio, kiosk and previously-paired deployments. No victim action is needed to trigger the event sequence.\nS:U - The corrupted state (hci_conn reference count and connection lifetime) lives entirely within the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The unbalanced hci_conn_drop() reintroduces a reference-count underflow (CWE-911) on a kernel object, which can drive the connection to teardown while pairing-state-machine work still references it — a use-after-free class defect whose reclaimed memory can be leveraged for kernel information disclosure.\nI:H - The same refcount underflow lets an attacker-controlled peer desynchronize hci_conn lifetime accounting, and a freed-then-reused hci_conn under remote-influenced heap grooming yields write/control-flow primitives; the guidance treats use-after-free as High integrity impact.\nA:H - A remote peer can reliably stall SSP so pairing never completes, trigger WARN_ON(refcnt < 0) in hci_conn_timeout() (a panic on panic_on_warn builds such as Android and hardened distro kernels), abort a live ACL link prematurely, or leak connections that never time out and exhaust the controller's ACL slots."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"versions": [
{
"version": "ccb8618c972f941ebc6b2b9db491025b3369efcb",
"lessThan": "afec8f772296dd8e5a2a6f83bbf99db1b9ca877f",
"status": "affected",
"versionType": "git"
},
{
"version": "1769ac55dbf3114d5bf79f11bd5dca80ee263f9c",
"lessThan": "79820a7e1e057120c49be07cbe10643d0706b259",
"status": "affected",
"versionType": "git"
},
{
"version": "40a33a129d99639921ce00d274cca44ba282f1ac",
"lessThan": "df193568d61234c81de7ed4d540c01975de60277",
"status": "affected",
"versionType": "git"
},
{
"version": "1ef071526848cc3109ade63268854cd7c20ece0c",
"lessThan": "c3df637266df29edee85e94cab5fd7041e5753ba",
"status": "affected",
"versionType": "git"
},
{
"version": "25e5d2883002e235f3378b8592aad14aeeef898c",
"lessThan": "30a5e812f78e3d1cced90e1ed750bf027599205f",
"status": "affected",
"versionType": "git"
},
{
"version": "c7f59461f5a78994613afc112cdd73688aef9076",
"lessThan": "fba268ac36ab19f9763ff90d276cde0ce6cd5f31",
"status": "affected",
"versionType": "git"
},
{
"version": "c7f59461f5a78994613afc112cdd73688aef9076",
"lessThan": "8e2758cc25891d2b76717aaf89b40ed215de188c",
"status": "affected",
"versionType": "git"
},
{
"version": "c7f59461f5a78994613afc112cdd73688aef9076",
"lessThan": "7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865",
"status": "affected",
"versionType": "git"
},
{
"version": "2c7f9fda663a1b31a61744ffc456bdb89c4efc7f",
"status": "affected",
"versionType": "git"
},
{
"version": "746dbb0fc6392eca23de27f8aa9d13979b564889",
"status": "affected",
"versionType": "git"
},
{
"version": "4.19.297",
"lessThan": "4.19.309",
"status": "affected",
"versionType": "semver"
},
{
"version": "5.4.259",
"lessThan": "5.4.271",
"status": "affected",
"versionType": "semver"
},
{
"version": "5.10.199",
"lessThan": "5.10.212",
"status": "affected",
"versionType": "semver"
},
{
"version": "5.15.137",
"lessThan": "5.15.151",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.1.60",
"lessThan": "6.1.81",
"status": "affected",
"versionType": "semver"
},
{
"version": "4.14.328",
"lessThan": "4.15",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.5.9",
"lessThan": "6.6",
"status": "affected",
"versionType": "semver"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"versions": [
{
"version": "6.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.6",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "4.19.309",
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.4.271",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.212",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.151",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.81",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.21",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.7.9",
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.8",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.297",
"versionEndExcluding": "4.19.309"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.259",
"versionEndExcluding": "5.4.271"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.199",
"versionEndExcluding": "5.10.212"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.137",
"versionEndExcluding": "5.15.151"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.60",
"versionEndExcluding": "6.1.81"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6",
"versionEndExcluding": "6.6.21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6",
"versionEndExcluding": "6.7.9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6",
"versionEndExcluding": "6.8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.328"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.9"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f"
},
{
"url": "https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259"
},
{
"url": "https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277"
},
{
"url": "https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba"
},
{
"url": "https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f"
},
{
"url": "https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31"
},
{
"url": "https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c"
},
{
"url": "https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865"
}
],
"title": "Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST",
"x_generator": {
"engine": "bippy-1.2.0"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2024-06-12T15:20:36.979047Z",
"id": "CVE-2024-27416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2024-06-12T15:20:51.306Z"
}
},
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-02T00:34:52.342Z"
},
"title": "CVE Program Container",
"references": [
{
"url": "https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c",
"tags": [
"x_transferred"
]
},
{
"url": "https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
"tags": [
"x_transferred"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
"tags": [
"x_transferred"
]
}
]
}
]
},
"dataVersion": "5.2"
}
View Git Blame Copy Permalink