Bluetooth HCI_AMP Support Removal Vulnerability in Linux Kernel
Summary
CVE-2024-38620: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of c... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including Bluetooth communication. The recent removal of HCI_AMP (Alternate MAC/PHY) support indicates a shift in how Bluetooth controllers are managed, as only HCI_PRIMARY controllers are now utilized. This change aims to streamline Bluetooth operations but has introduced a vulnerability that needs addressing.
Vulnerability Detail
In the Linux kernel, the removal of HCI_AMP support has led to a vulnerability where HCI_AMP controllers are no longer functional. The capability to create AMP controllers has been eliminated, which may affect systems relying on this feature. The vulnerability arises from the lack of differentiation between AMP and Primary controllers, leading to potential misconfigurations and operational issues in Bluetooth communication. This could result in degraded performance or unexpected behavior in Bluetooth-enabled devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to monitor updates from the Linux kernel maintainers and apply patches as they become available.
Conclusion
The removal of HCI_AMP support in the Linux kernel has introduced a vulnerability that affects Bluetooth communication. Users are encouraged to update their systems to the latest kernel version to mitigate potential issues. Staying informed about updates and security advisories is essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
HCI_AMP stands for Alternate MAC/PHY, which is a Bluetooth feature that allows for the use of alternate physical layers for communication.
This vulnerability may lead to issues with Bluetooth communication, particularly for devices that previously relied on HCI_AMP support.
Yes, all versions of the Linux kernel that include HCI_AMP support are affected. Check your kernel version and update accordingly.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to mitigate risks.
You can find detailed information about this vulnerability in the official Linux kernel release notes and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
