CVE-2024-42132

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42132
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42132.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42132
Downstream
BELL (1)
DEBIAN (1)
MGASA (2)
OESA (1)
RHSA (1)
SUSE (5)
UBUNTU (1)
Related
SUSE (5)
Published
2024-07-30T07:46:27Z
Modified
2026-10-08T02:48:42Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
Details

In the Linux kernel, the following vulnerability has been resolved:

bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX

Syzbot hit warning in hci_conn_del() caused by freeing handle that was not allocated using ida allocator.

This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by hci_le_big_sync_established_evt(), which makes code think it's unset connection.

Add same check for handle upper bound as in hci_conn_set_handle() to prevent warning.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42132.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f7e83f2278f06b577e3c92ea2f4e8e8c6fc72a8f
Fixed
2ae8d7742a09c275872e670c53337b3dcedaa11c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
84cb0143fb8a03bf941c7aaedd56c938c99dafad
Fixed
4970e48f83dbd21d2a6a7cdaaafc2a71f7f45dc4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
181a42edddf51d5d9697ecdf365d72ebeab5afb0
Fixed
d311036696fed778301d08a71a4bef737b86d8c5
Fixed
1cc18c2ab2e8c54c355ea7c0423a636e415a0c23
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.6.2
Fixed
6.6.39
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.5.12
Fixed
6.6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e9f708beada55426c8d678e2f46af659eb5bf4f0

Affected versions

v6.*
v6.5.12
v6.5.13
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42132.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.6.39
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42132.json"