{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-42133", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-42133" ], "published": "2024-07-30T07:47:52Z", "summary": "Bluetooth: Ignore too large handle values in BIG", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Ignore too large handle values in BIG\n\nhci_le_big_sync_established_evt is necessary to filter out cases where the\nhandle value is belonging to ida id range, otherwise ida will be erroneously\nreleased in hci_conn_cleanup.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.6.20-1+rpt1", "1:6.6.28-1+rpt1", "1:6.6.31-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.6.20+rpt-rpi-2712", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v6", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v7", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v7l", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v8", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-2712", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v6", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v7", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v7l", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v8", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-2712", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v6", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v7", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v7l", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v8", "binary_version": "1:6.6.31-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.6.20-1+rpt1": { "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668", "upstream_version": "6.6.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.39" }, "1:6.6.28-1+rpt1": { "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e", "upstream_version": "6.6.28", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.39" }, "1:6.6.31-1+rpt1": { "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424", "upstream_version": "6.6.31", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.39" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42133" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a06a8cc80fa203fde828a8429583f7e4fe27eca4" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/38263088b845abeeeb98dda5b87c0de3063b6dbb" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/dad0003ccc68457baf005a6ed75b4d321463fe3d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/015d79c96d62cd8a4a359fcf5be40d58088c936b" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.6, "cvss_v3_severity": "High", "scenario": "AV:A - The vulnerable code is the Bluetooth HCI event path (`hci_le_big_sync_established_evt`), reached only as a consequence of synchronizing to a Broadcast Isochronous Group advertised by a remote device in radio range. Per Bluetooth scoring convention this is Adjacent.\nAC:L - No race, no memory-layout grooming, and no timing dependency \u2014 a single BIG Sync Established event carrying a BIS handle above 0x0eff deterministically creates a bogus \"unset\" hci_conn whose teardown always hits the ida_free WARN.\nPR:N - Broadcast/periodic-advertising sync (LE Audio / Auracast) requires no pairing, bonding, or authentication, and no local account is needed; the attacker is an unauthenticated peer in range of a host with LE Audio/ISO enabled.\nUI:N - The event handler runs automatically in `hci_rx_work` as part of normal broadcast-sync processing on a configured ISO sink; no victim action is required at attack time.\nS:U - The corruption is confined to the kernel's own Bluetooth connection hash and IDA state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - The `WARN(1, ...)` in `ida_free()` emits a full register and stack backtrace containing kernel text and heap addresses, giving a bounded KASLR-defeating info leak, and duplicate handles can route inbound ACL/ISO data to the wrong connection; there is no arbitrary read primitive.\nI:L - The bogus handle desynchronizes `hdev->unset_handle_ida` so the same handle is issued to a second live connection and `hci_conn_hash_lookup_handle()` resolves to the wrong `hci_conn`, letting ISO QoS state and L2CAP processing be applied to a mismatched link object. This is bounded kernel-state modification, not an arbitrary write.\nA:H - The bug reliably triggers a kernel WARNING, which is a panic on the many deployments (Android, CI, hardened distros) running with `panic_on_warn`, and the resulting duplicate-handle confusion persistently disrupts Bluetooth connection handling." } } }