CVE-2024-36880

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36880

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.

References
Link Resource
https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e Patch
https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c Patch
https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d Patch
https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d Patch
https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 Patch
https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e Patch
https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c Patch
https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d Patch
https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d Patch
https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
History

30 Sep 2025, 17:46

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e - () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e - Patch
References () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c - () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c - Patch
References () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d - () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d - Patch
References () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d - () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d - Patch
References () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 - () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 09:22

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Bluetooth: qca: agregar comprobaciones de integridad del firmware faltantes Agregue las comprobaciones de integridad del firmware faltantes al analizar los archivos de firmware antes de descargarlos para evitar acceder y dañar la memoria más allá del búfer vmalloced.
References () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e - () https://git.kernel.org/stable/c/02f05ed44b71152d5e11d29be28aed91c0489b4e -
References () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c - () https://git.kernel.org/stable/c/1caceadfb50432dbf6d808796cb6c34ebb6d662c -
References () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d - () https://git.kernel.org/stable/c/2e4edfa1e2bd821a317e7d006517dcf2f3fac68d -
References () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d - () https://git.kernel.org/stable/c/427281f9498ed614f9aabc80e46ec077c487da6d -
References () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 - () https://git.kernel.org/stable/c/ed53949cc92e28aaa3463d246942bda1fbb7f307 -

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-09-30 17:46

NVD link : CVE-2024-36880

Mitre link : CVE-2024-36880

CVE.ORG link : CVE-2024-36880

JSON object : View

Products Affected

linux

CWE
NVD-CWE-noinfo