{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-38620","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-06-18T19:36:34.945Z","datePublished":"2024-06-20T08:03:43.906Z","dateUpdated":"2026-08-23T12:45:18.071Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-23T12:45:18.071Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Remove HCI_AMP support\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev->dev_type altogether."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The broken paths (`l2cap_recv_acldata`, `l2cap_connect`, `l2cap_connect_cfm`→`l2cap_conn_add`, `hci_queue_acl`, `hci_num_comp_blocks_evt`) all process ACL/L2CAP traffic and link events originating from a remote Bluetooth peer in radio range of an AMP-capable controller, which real hardware ships as (btusb USB class e0/01/04, btmrvl SDIO combo chips, btsdio SDIO_CLASS_BT_AMP, virtio-bt). Bluetooth radio proximity is the adjacent-network vector.\nAC:L - Once an HCI_AMP controller is present — the default state on affected hardware, requiring no attacker setup — the inconsistent paths are reached deterministically by initiating an ACL/L2CAP connection and sending data; there is no race and no memory layout the attacker cannot influence.\nPR:N - An adjacent Bluetooth attacker needs no credentials on the target: `hci_conn_request_evt` and `l2cap_connect_cfm`/`l2cap_conn_add` run before any pairing or authorization, and `l2cap_connect` explicitly exempts the SDP PSM from the link-mode security check.\nUI:N - No victim action is required — inbound connection establishment and ACL data reception are handled autonomously by the kernel once Bluetooth is up.\nS:U - All corruption and crashes stay inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `hci_queue_acl()` builds ACL headers from `chan->handle` rather than `conn->handle` on AMP hdevs, so L2CAP payloads can be emitted tagged with the wrong link handle, and the state corruption in the connection/scheduler bookkeeping is of a class leverageable for kernel memory disclosure.\nI:H - `hci_num_comp_blocks_evt` applies an unbounded `conn->sent -= block_count` to a `hci_chan` that should never have existed, underflowing an unsigned counter that drives `hci_quote_sent`/`hci_low_sent` quota arithmetic, and the ACL handle confusion lets frames be attributed to the wrong connection — kernel state under attacker influence.\nA:H - `__get_blocks()` divides by controller-supplied `hdev->block_len` on the block-based path that only AMP controllers select, giving a divide-by-zero kernel oops; separately, `hci_sched_acl()` never drains the AMP queues so `chan->data_q` grows without bound until memory is exhausted."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmrvl_main.c","drivers/bluetooth/btrsi.c","drivers/bluetooth/btsdio.c","drivers/bluetooth/btusb.c","drivers/bluetooth/hci_bcm4377.c","drivers/bluetooth/hci_ldisc.c","drivers/bluetooth/hci_serdev.c","drivers/bluetooth/hci_uart.h","drivers/bluetooth/hci_vhci.c","drivers/bluetooth/virtio_bt.c","include/net/bluetooth/hci.h","include/net/bluetooth/hci_core.h","include/uapi/linux/virtio_bt.h","net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_event.c","net/bluetooth/hci_sock.c","net/bluetooth/hci_sync.c","net/bluetooth/l2cap_core.c","net/bluetooth/mgmt.c"],"versions":[{"version":"244bc377591c3882f454882357bc730c90cbedb5","lessThan":"9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2","status":"affected","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","lessThan":"5af2e235b0d5b797e9531a00c50058319130e156","status":"affected","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","lessThan":"d3c7b012d912b31ad23b9349c0e499d6dddd48ec","status":"affected","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","lessThan":"af1d425b6dc67cd67809f835dd7afb6be4d43e03","status":"affected","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","lessThan":"84a4bb6548a29326564f0e659fb8064503ecc1c7","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmrvl_main.c","drivers/bluetooth/btrsi.c","drivers/bluetooth/btsdio.c","drivers/bluetooth/btusb.c","drivers/bluetooth/hci_bcm4377.c","drivers/bluetooth/hci_ldisc.c","drivers/bluetooth/hci_serdev.c","drivers/bluetooth/hci_uart.h","drivers/bluetooth/hci_vhci.c","drivers/bluetooth/virtio_bt.c","include/net/bluetooth/hci.h","include/net/bluetooth/hci_core.h","include/uapi/linux/virtio_bt.h","net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_event.c","net/bluetooth/hci_sock.c","net/bluetooth/hci_sync.c","net/bluetooth/l2cap_core.c","net/bluetooth/mgmt.c"],"versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","status":"unaffected","versionType":"semver"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.33","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.12","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9.3","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.6.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.9.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2"},{"url":"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156"},{"url":"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec"},{"url":"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03"},{"url":"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7"}],"title":"Bluetooth: HCI: Remove HCI_AMP support","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-20T16:21:10.645379Z","id":"CVE-2024-38620","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-20T16:22:30.641Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T04:12:26.064Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7","tags":["x_transferred"]}]}]}}