CVE-2024-36032 (GCVE-0-2024-36032)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:23 – Updated: 2026-08-05 11:31
VLAI
Title
Bluetooth: qca: fix info leak when fetching fw build id
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
2.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-31 18:33 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 , < 62d5550ab62042dcceaf18844d0feadbb962cffe (git)
Affected: c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 , < 57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488 (git)
Affected: c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 , < 6b63e0ef4d3ce0080395e5091fba2023f246c45a (git)
Affected: c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 , < a571044cc0a0c944e7c12237b6768aeedd7480e1 (git)
Affected: c0187b0bd3e94c48050687d87b2c3c9fbae98ae9 , < cda0d6a198e2a7ec6f176c36173a57bdd8af7af2 (git)
Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 2.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:33:16.549121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T17:21:15.085Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btqca.c",
            "drivers/bluetooth/btqca.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "62d5550ab62042dcceaf18844d0feadbb962cffe",
              "status": "affected",
              "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
              "versionType": "git"
            },
            {
              "lessThan": "57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488",
              "status": "affected",
              "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
              "versionType": "git"
            },
            {
              "lessThan": "6b63e0ef4d3ce0080395e5091fba2023f246c45a",
              "status": "affected",
              "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
              "versionType": "git"
            },
            {
              "lessThan": "a571044cc0a0c944e7c12237b6768aeedd7480e1",
              "status": "affected",
              "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
              "versionType": "git"
            },
            {
              "lessThan": "cda0d6a198e2a7ec6f176c36173a57bdd8af7af2",
              "status": "affected",
              "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btqca.c",
            "drivers/bluetooth/btqca.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: fix info leak when fetching fw build id\n\nAdd the missing sanity checks and move the 255-byte build-id buffer off\nthe stack to avoid leaking stack data through debugfs in case the\nbuild-info reply is malformed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed build-info reply is supplied by the Bluetooth controller across the HCI/UART transport, so the attacker position is a rogue or over-the-air-compromised QCA BT SoC in Bluetooth radio range of the phone/embedded device \u2014 an adjacent-network attack surface, consistent with prior kernel-CNA scoring of HCI-transport-sourced data (CVE-2024-36968).\nAC:L - The controller deterministically chooses the event length and the length byte (e.g. a 3-byte reply with data[0]=254 for the slab overread, or data[0]=255 for the uninitialized-stack leak); there is no race, timing window, or memory-layout luck, and the path re-runs on every bring-up and subsystem restart.\nPR:N - qca_read_fw_build_info() runs unconditionally from hdev-\u003esetup during HCI device initialisation at boot/rfkill-unblock/SSR with no authentication and no host account required, and the resulting leak lands in a 0444-mode debugfs node rather than behind any credential check.\nUI:N - Bluetooth setup is performed automatically by the kernel when the HCI device is brought up; no victim action such as pairing, mounting, or opening a file is involved.\nS:U - Both the out-of-bounds reads and the disclosed data stay within the kernel\u0027s own memory and security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is an out-of-bounds read of up to ~254 bytes of adjacent slab memory past the skb buffer plus an unbounded kernel-stack overread (vsnprintf \"%s\" over a never-initialised 255-byte stack buffer), repeatable on every controller reset and exfiltrated through debugfs \u2014 far beyond a small bounded read, and sufficient to recover kernel pointers and defeat KASLR.\nI:N - The defect is purely a read overrun; the leaked bytes are written into a correctly sized kvasprintf allocation, so no kernel data outside the driver\u0027s own fw_info string is modified.\nA:H - The unbounded string walk off the end of the 255-byte stack buffer can run into the VMAP_STACK guard page, and the slab overread can hit a KFENCE-guarded page, producing an oops during Bluetooth initialisation \u2014 a panic on the panic_on_oops/panic_on_warn configurations common in Android, automotive, and embedded deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:42.475Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe"
        },
        {
          "url": "https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2"
        }
      ],
      "title": "Bluetooth: qca: fix info leak when fetching fw build id",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36032",
    "datePublished": "2024-05-30T15:23:47.423Z",
    "dateReserved": "2024-05-17T13:50:33.160Z",
    "dateUpdated": "2026-08-05T11:31:42.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36032",
      "date": "2026-10-09",
      "epss": "0.00354",
      "percentile": "0.27114"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/btqca.c",
                  "drivers/bluetooth/btqca.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "62d5550ab62042dcceaf18844d0feadbb962cffe",
                    "status": "affected",
                    "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488",
                    "status": "affected",
                    "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6b63e0ef4d3ce0080395e5091fba2023f246c45a",
                    "status": "affected",
                    "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a571044cc0a0c944e7c12237b6768aeedd7480e1",
                    "status": "affected",
                    "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cda0d6a198e2a7ec6f176c36173a57bdd8af7af2",
                    "status": "affected",
                    "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/btqca.c",
                  "drivers/bluetooth/btqca.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.162",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.91",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.31",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD852924-11EF-4EBB-B88D-50A6300754D3",
                    "versionEndExcluding": "5.15.162",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F8C886C-75AA-469B-A6A9-12BF1A29C0D5",
                    "versionEndExcluding": "6.1.91",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00",
                    "versionEndExcluding": "6.6.31",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3",
                    "versionEndExcluding": "6.8.10",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "91326417-E981-482E-A5A3-28BC1327521B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "DAECDCD8-F556-4606-8D7B-5C6D47A501F2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: fix info leak when fetching fw build id\n\nAdd the missing sanity checks and move the 255-byte build-id buffer off\nthe stack to avoid leaking stack data through debugfs in case the\nbuild-info reply is malformed."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: qca: corrige la fuga de informaci\u00f3n al recuperar el ID de compilaci\u00f3n del firmware. Agregue las comprobaciones de cordura que faltan y mueva el b\u00fafer de ID de compilaci\u00f3n de 255 bytes fuera de la pila para evitar la filtraci\u00f3n de datos de la pila a trav\u00e9s de debugfs en en caso de que la respuesta de informaci\u00f3n de compilaci\u00f3n est\u00e9 mal formada."
          }
        ],
        "id": "CVE-2024-36032",
        "lastModified": "2026-08-04T11:18:24.433",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 2.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 1.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-36032",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:33:16.549121Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-30T16:15:11.490",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-668"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:45:42+00:00",
      "cve": "CVE-2024-36032",
      "id": "CVE-2024-36032",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: qca: fix info leak when fetching fw build id",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36032.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:30:12.639Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "NONE",
                  "baseScore": 2.3,
                  "baseSeverity": "LOW",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "HIGH",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-36032",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-31T18:33:16.549121Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-31T18:33:19.911Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/bluetooth/btqca.c",
                "drivers/bluetooth/btqca.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "62d5550ab62042dcceaf18844d0feadbb962cffe",
                  "status": "affected",
                  "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                  "versionType": "git"
                },
                {
                  "lessThan": "57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488",
                  "status": "affected",
                  "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                  "versionType": "git"
                },
                {
                  "lessThan": "6b63e0ef4d3ce0080395e5091fba2023f246c45a",
                  "status": "affected",
                  "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                  "versionType": "git"
                },
                {
                  "lessThan": "a571044cc0a0c944e7c12237b6768aeedd7480e1",
                  "status": "affected",
                  "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                  "versionType": "git"
                },
                {
                  "lessThan": "cda0d6a198e2a7ec6f176c36173a57bdd8af7af2",
                  "status": "affected",
                  "version": "c0187b0bd3e94c48050687d87b2c3c9fbae98ae9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/bluetooth/btqca.c",
                "drivers/bluetooth/btqca.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.12"
                },
                {
                  "lessThan": "5.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.162",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.91",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.31",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.162",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.91",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.31",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.10",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: fix info leak when fetching fw build id\n\nAdd the missing sanity checks and move the 255-byte build-id buffer off\nthe stack to avoid leaking stack data through debugfs in case the\nbuild-info reply is malformed."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - The malformed build-info reply is supplied by the Bluetooth controller across the HCI/UART transport, so the attacker position is a rogue or over-the-air-compromised QCA BT SoC in Bluetooth radio range of the phone/embedded device \u2014 an adjacent-network attack surface, consistent with prior kernel-CNA scoring of HCI-transport-sourced data (CVE-2024-36968).\nAC:L - The controller deterministically chooses the event length and the length byte (e.g. a 3-byte reply with data[0]=254 for the slab overread, or data[0]=255 for the uninitialized-stack leak); there is no race, timing window, or memory-layout luck, and the path re-runs on every bring-up and subsystem restart.\nPR:N - qca_read_fw_build_info() runs unconditionally from hdev-\u003esetup during HCI device initialisation at boot/rfkill-unblock/SSR with no authentication and no host account required, and the resulting leak lands in a 0444-mode debugfs node rather than behind any credential check.\nUI:N - Bluetooth setup is performed automatically by the kernel when the HCI device is brought up; no victim action such as pairing, mounting, or opening a file is involved.\nS:U - Both the out-of-bounds reads and the disclosed data stay within the kernel\u0027s own memory and security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is an out-of-bounds read of up to ~254 bytes of adjacent slab memory past the skb buffer plus an unbounded kernel-stack overread (vsnprintf \"%s\" over a never-initialised 255-byte stack buffer), repeatable on every controller reset and exfiltrated through debugfs \u2014 far beyond a small bounded read, and sufficient to recover kernel pointers and defeat KASLR.\nI:N - The defect is purely a read overrun; the leaked bytes are written into a correctly sized kvasprintf allocation, so no kernel data outside the driver\u0027s own fw_info string is modified.\nA:H - The unbounded string walk off the end of the 255-byte stack buffer can run into the VMAP_STACK guard page, and the slab overread can hit a KFENCE-guarded page, producing an oops during Bluetooth initialisation \u2014 a panic on the panic_on_oops/panic_on_warn configurations common in Android, automotive, and embedded deployments."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:31:42.475Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/62d5550ab62042dcceaf18844d0feadbb962cffe"
            },
            {
              "url": "https://git.kernel.org/stable/c/57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488"
            },
            {
              "url": "https://git.kernel.org/stable/c/6b63e0ef4d3ce0080395e5091fba2023f246c45a"
            },
            {
              "url": "https://git.kernel.org/stable/c/a571044cc0a0c944e7c12237b6768aeedd7480e1"
            },
            {
              "url": "https://git.kernel.org/stable/c/cda0d6a198e2a7ec6f176c36173a57bdd8af7af2"
            }
          ],
          "title": "Bluetooth: qca: fix info leak when fetching fw build id",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-36032",
        "datePublished": "2024-05-30T15:23:47.423Z",
        "dateReserved": "2024-05-17T13:50:33.160Z",
        "dateUpdated": "2026-08-05T11:31:42.475Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.