CVE-2024-42132

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-42132

Import Source

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-42132

Downstream

Related

Published

2024-07-30T08:15:05Z

Modified

2024-12-11T17:35:31Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

[none]

Details

In the Linux kernel, the following vulnerability has been resolved:

bluetooth/hci: disallow setting handle bigger than HCICONNHANDLE_MAX

Syzbot hit warning in hciconndel() caused by freeing handle that was not allocated using ida allocator.

This is caused by handle bigger than HCICONNHANDLEMAX passed by hcilebigsyncestablishedevt(), which makes code think it's unset connection.

Add same check for handle upper bound as in hciconnset_handle() to prevent warning.

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.9.9-1

{
    "urgency": "not yet assigned"
}