CVE-2024-36880

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-36880", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.064Z", "datePublished": "2024-05-30T15:28:51.518Z", "dateUpdated": "2026-08-05T11:31:47.937Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:47.937Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: add missing firmware sanity checks\n\nAdd the missing sanity checks when parsing the firmware files before\ndownloading them to avoid accessing and corrupting memory beyond the\nvmalloced buffer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed data is a firmware/NVM file read via request_firmware() from a local firmware search path (/lib/firmware*, firmware_class.path); the Bluetooth controller can only steer filename selection, not content, so there is no remote or adjacent input into the parser. Exploitation therefore requires local access to place the crafted file.\nAC:L - A crafted NVM file with a 24-bit length field of 0xffffff deterministically drives the unbounded while-loop past the end of the exactly-sized vmalloc buffer on every Bluetooth setup; there is no race, timing window, or memory-layout luck required to trigger the out-of-bounds walk.\nPR:L - The attacker needs write access to a firmware search path rather than kernel privileges \u2014 on embedded, automotive, Android and IoT deployments this is routinely held by a non-root firmware/OTA service account or a writable vendor partition, so a low-privileged local principal can convert file-write into kernel memory corruption.\nUI:N - qca_tlv_check_data() runs from hdev->setup during HCI device bring-up, which happens automatically at boot, on bluetoothd start, on rfkill unblock, and on QCA subsystem-restart recovery; no deliberate action by another user is needed.\nS:U - The out-of-bounds reads and writes stay within the kernel's own memory and security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The TLV_TYPE_NVM loop performs an essentially unbounded out-of-bounds read walking up to 16 MiB past a page-sized vmalloc allocation, and the resulting memory corruption of adjacent vmalloc objects can be leveraged for disclosure, so this is not a small bounded read.\nI:H - The parser writes out of bounds (tlv_nvm->data[0] |= 0x80, data[1]/data[2] = nvm_baud_rate, data[0] |= 0x01) at offsets driven by a tag_len that is itself read from OOB memory, letting the walk skip vmalloc guard pages and corrupt neighbouring allocations such as module data or VMAP_STACK kernel stacks \u2014 a control-flow-relevant write primitive.\nA:H - Walking a multi-megabyte range past a small vmalloc buffer will hit a vmalloc guard page or unmapped region, producing an oops/panic during Bluetooth initialisation and leaving the device unusable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btqca.c"], "versions": [{"version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "ed53949cc92e28aaa3463d246942bda1fbb7f307", "status": "affected", "versionType": "git"}, {"version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "1caceadfb50432dbf6d808796cb6c34ebb6d662c", "status": "affected", "versionType": "git"}, {"version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "427281f9498ed614f9aabc80e46ec077c487da6d", "status": "affected", "versionType": "git"}, {"version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "02f05ed44b71152d5e11d29be28aed91c0489b4e", "status": "affected", "versionType": "git"}, {"version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/btqca.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.159", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.91", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "5.15.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.1.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.6.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.8.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307"}, {"url": "https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c"}, {"url": "https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d"}, {"url": "https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e"}, {"url": "https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d"}], "title": "Bluetooth: qca: add missing firmware sanity checks", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T16:40:42.596232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:41.364Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:49.156Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:49.156Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-03T16:40:42.596232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-03T16:41:45.672Z"}}], "cna": {"title": "Bluetooth: qca: add missing firmware sanity checks", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed data is a firmware/NVM file read via request_firmware() from a local firmware search path (/lib/firmware*, firmware_class.path); the Bluetooth controller can only steer filename selection, not content, so there is no remote or adjacent input into the parser. Exploitation therefore requires local access to place the crafted file.\nAC:L - A crafted NVM file with a 24-bit length field of 0xffffff deterministically drives the unbounded while-loop past the end of the exactly-sized vmalloc buffer on every Bluetooth setup; there is no race, timing window, or memory-layout luck required to trigger the out-of-bounds walk.\nPR:L - The attacker needs write access to a firmware search path rather than kernel privileges \u2014 on embedded, automotive, Android and IoT deployments this is routinely held by a non-root firmware/OTA service account or a writable vendor partition, so a low-privileged local principal can convert file-write into kernel memory corruption.\nUI:N - qca_tlv_check_data() runs from hdev->setup during HCI device bring-up, which happens automatically at boot, on bluetoothd start, on rfkill unblock, and on QCA subsystem-restart recovery; no deliberate action by another user is needed.\nS:U - The out-of-bounds reads and writes stay within the kernel's own memory and security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The TLV_TYPE_NVM loop performs an essentially unbounded out-of-bounds read walking up to 16 MiB past a page-sized vmalloc allocation, and the resulting memory corruption of adjacent vmalloc objects can be leveraged for disclosure, so this is not a small bounded read.\nI:H - The parser writes out of bounds (tlv_nvm->data[0] |= 0x80, data[1]/data[2] = nvm_baud_rate, data[0] |= 0x01) at offsets driven by a tag_len that is itself read from OOB memory, letting the walk skip vmalloc guard pages and corrupt neighbouring allocations such as module data or VMAP_STACK kernel stacks \u2014 a control-flow-relevant write primitive.\nA:H - Walking a multi-megabyte range past a small vmalloc buffer will hit a vmalloc guard page or unmapped region, producing an oops/panic during Bluetooth initialisation and leaving the device unusable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "ed53949cc92e28aaa3463d246942bda1fbb7f307", "versionType": "git"}, {"status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "1caceadfb50432dbf6d808796cb6c34ebb6d662c", "versionType": "git"}, {"status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "427281f9498ed614f9aabc80e46ec077c487da6d", "versionType": "git"}, {"status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "02f05ed44b71152d5e11d29be28aed91c0489b4e", "versionType": "git"}, {"status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "lessThan": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d", "versionType": "git"}], "programFiles": ["drivers/bluetooth/btqca.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"status": "unaffected", "version": "0", "lessThan": "4.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.159", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.91", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.31", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.10", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/bluetooth/btqca.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307"}, {"url": "https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c"}, {"url": "https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d"}, {"url": "https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e"}, {"url": "https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: add missing firmware sanity checks\n\nAdd the missing sanity checks when parsing the firmware files before\ndownloading them to avoid accessing and corrupting memory beyond the\nvmalloced buffer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.159", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.91", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.31", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.10", "versionStartIncluding": "4.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "4.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:47.937Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36880", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:31:47.937Z", "dateReserved": "2024-05-30T15:25:07.064Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-30T15:28:51.518Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/btqca.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ed53949cc92e28aaa3463d246942bda1fbb7f307", "status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "versionType": "git"}, {"lessThan": "1caceadfb50432dbf6d808796cb6c34ebb6d662c", "status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "versionType": "git"}, {"lessThan": "427281f9498ed614f9aabc80e46ec077c487da6d", "status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "versionType": "git"}, {"lessThan": "02f05ed44b71152d5e11d29be28aed91c0489b4e", "status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "versionType": "git"}, {"lessThan": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d", "status": "affected", "version": "83e81961ff7ef75f97756f316caea5aa6bcc19cc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/btqca.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.159", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.91", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.31", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "99265755-4B43-4864-B46E-F1162838D864", "versionEndExcluding": "5.15.159", "versionStartIncluding": "4.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F8C886C-75AA-469B-A6A9-12BF1A29C0D5", "versionEndExcluding": "6.1.91", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00", "versionEndExcluding": "6.6.31", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3", "versionEndExcluding": "6.8.10", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*", "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*", "matchCriteriaId": "91326417-E981-482E-A5A3-28BC1327521B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*", "matchCriteriaId": "DAECDCD8-F556-4606-8D7B-5C6D47A501F2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: add missing firmware sanity checks\n\nAdd the missing sanity checks when parsing the firmware files before\ndownloading them to avoid accessing and corrupting memory beyond the\nvmalloced buffer."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Bluetooth: qca: agregar comprobaciones de integridad del firmware faltantes Agregue las comprobaciones de integridad del firmware faltantes al analizar los archivos de firmware antes de descargarlos para evitar acceder y da\u00f1ar la memoria m\u00e1s all\u00e1 del b\u00fafer vmalloced."}], "id": "CVE-2024-36880", "lastModified": "2026-08-04T11:18:26.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36880", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-03T16:40:42.596232Z", "version": "2.0.3"}}]}, "published": "2024-05-30T16:15:11.640", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: Bluetooth: qca: add missing firmware sanity checks", "id": "2284280", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284280"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: qca: add missing firmware sanity checks\nAdd the missing sanity checks when parsing the firmware files before\ndownloading them to avoid accessing and corrupting memory beyond the\nvmalloced buffer."], "name": "CVE-2024-36880", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36880\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36880\nhttps://lore.kernel.org/linux-cve-announce/2024053031-CVE-2024-36880-c961@gregkh/T"], "threat_severity": "Low"}

{}