CVE-2024-36880: Vulnerability in linux-libc-dev package - Bluetooth: qca: add missing firmware sanity checks
Summary
CVE-2024-36880: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid access... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs against the Linux kernel. It is an essential component for building and running applications on Linux systems. This package is specifically designed for the Debian operating system. The vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability CVE-2024-36880 in the linux-libc-dev package is related to the Bluetooth functionality. It involves missing firmware sanity checks in the qca driver. This vulnerability could potentially allow an attacker to access and corrupt memory beyond the allocated buffer, leading to various security issues. The vulnerability has been resolved by adding the necessary sanity checks when parsing firmware files before downloading them.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the linux-libc-dev package related to Bluetooth qca driver has been resolved by adding missing firmware sanity checks. Users are advised to update their linux-libc-dev package to a patched version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides header files and libraries for compiling C programs against the Linux kernel. It is necessary for building and running applications on Linux systems.
The vulnerability could allow an attacker to access and corrupt memory beyond the allocated buffer, potentially leading to security issues.
You can check the installed version of the linux-libc-dev package on your system and compare it with the affected version (6.1.90-1). If your system is running the affected version, it is recommended to update to a patched version.
No known exploits have been reported for this vulnerability at the moment.
You can find more information about this vulnerability on the Debian Security Tracker website and the National Vulnerability Database (NVD).
Related vulnerabilities
Recent vulnerabilities recorded for linux.
