{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-53144","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-11-19T17:17:24.997Z","datePublished":"2024-12-17T15:55:03.394Z","dateUpdated":"2026-08-05T11:44:06.956Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:44:06.956Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE\n\nThis aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4\n(\"Bluetooth: Always request for user confirmation for Just Works\")\nalways request user confirmation with confirm_hint set since the\nlikes of bluetoothd have dedicated policy around JUST_WORKS method\n(e.g. main.conf:JustWorksRepairing).\n\nCVE: CVE-2024-8805"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable code path is driven entirely by BR/EDR HCI events generated from an attacker-controlled Bluetooth peer (Connection Request, IO Capability Response, User Confirmation Request), requiring only radio proximity to the target. Per kernel scoring guidance Bluetooth reachability is Adjacent.\nAC:L - The attacker fully controls both parameters that select the vulnerable branch — its own IO capability (NoInputNoOutput) and authentication requirements (bonding without MITM) — making the silent auto-accept deterministic with no race, no memory-layout dependency, and no non-default kernel or BlueZ configuration.\nPR:N - The attacker is an entirely unknown, unpaired, unauthenticated remote device with no prior link key; the bug is reached during the initial pairing handshake before any trust relationship exists.\nUI:N - The defect is precisely that the kernel never invokes mgmt_user_confirm_request, so bluetoothd and the user are never consulted and the bond completes silently with no prompt, notification, or action from the victim.\nS:U - The vulnerable component and the compromised resources are the same host under a single security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unauthorized persistent bond makes the attacker a trusted device, enabling connections to profiles that expose highly sensitive data (PBAP phonebook and call logs, MAP SMS, OBEX FTP, audio) on phones and automotive head units, and HID keystroke injection escalates this to arbitrary user-level file read.\nI:H - The attacker writes an unauthorized link key into the host's persistent bonding database and can then act as a trusted HID keyboard/mouse to inject keystrokes and execute arbitrary commands as the logged-in user, push files via OPP, or drive the device over AVRCP/HFP.\nA:H - As a bonded peer the attacker can hijack and force-disconnect the legitimate input or audio device — the same \"speaker hijack or mouse/keyboard hijack\" outcome documented for the related bluedump attack — and HID command injection permits shutting down or otherwise disabling the system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/hci_event.c"],"versions":[{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"baaa50c6f91ea5a9c7503af51f2bc50e6568b66b","status":"affected","versionType":"git"},{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"22b49d6e4f399a390c70f3034f5fbacbb9413858","status":"affected","versionType":"git"},{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"d17c631ba04e960eb6f8728b10d585de20ac4f71","status":"affected","versionType":"git"},{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"830c03e58beb70b99349760f822e505ecb4eeb7e","status":"affected","versionType":"git"},{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"ad7adfb95f64a761e4784381e47bee1a362eb30d","status":"affected","versionType":"git"},{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"5291ff856d2c5177b4fe9c18828312be30213193","status":"affected","versionType":"git"},{"version":"ba15a58b179ed76a7e887177f2b06de12c58ec8f","lessThan":"b25e11f978b63cb7857890edb3a698599cddb10e","status":"affected","versionType":"git"},{"version":"373d1dfcffc63c68184419264a7eaed422c7958e","status":"affected","versionType":"git"},{"version":"bc96ff59b2f19e924d9e15e24cee19723d674b92","status":"affected","versionType":"git"},{"version":"6ab84785311dc4d0348e6bd4e1c491293b770b98","status":"affected","versionType":"git"},{"version":"778763287ded64dd5c022435d3e0e3182f148a64","status":"affected","versionType":"git"},{"version":"9a5fcacabde0fe11456f4a1e88072c01846cea25","status":"affected","versionType":"git"},{"version":"039da39a616103ec7ab8ac351bfb317854e5507c","status":"affected","versionType":"git"},{"version":"3.2.61","lessThan":"3.3","status":"affected","versionType":"semver"},{"version":"3.4.98","lessThan":"3.5","status":"affected","versionType":"semver"},{"version":"3.10.48","lessThan":"3.11","status":"affected","versionType":"semver"},{"version":"3.12.25","lessThan":"3.13","status":"affected","versionType":"semver"},{"version":"3.14.12","lessThan":"3.15","status":"affected","versionType":"semver"},{"version":"3.15.5","lessThan":"3.16","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/hci_event.c"],"versions":[{"version":"3.16","status":"affected"},{"version":"0","lessThan":"3.16","status":"unaffected","versionType":"semver"},{"version":"5.10.236","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.180","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.113","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.55","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.14","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11.3","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.10.236"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.15.180"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.6.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.10.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.11.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.98"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10.48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12.25"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.15.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/baaa50c6f91ea5a9c7503af51f2bc50e6568b66b"},{"url":"https://git.kernel.org/stable/c/22b49d6e4f399a390c70f3034f5fbacbb9413858"},{"url":"https://git.kernel.org/stable/c/d17c631ba04e960eb6f8728b10d585de20ac4f71"},{"url":"https://git.kernel.org/stable/c/830c03e58beb70b99349760f822e505ecb4eeb7e"},{"url":"https://git.kernel.org/stable/c/ad7adfb95f64a761e4784381e47bee1a362eb30d"},{"url":"https://git.kernel.org/stable/c/5291ff856d2c5177b4fe9c18828312be30213193"},{"url":"https://git.kernel.org/stable/c/b25e11f978b63cb7857890edb3a698599cddb10e"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1229/"}],"title":"Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T22:29:43.667Z"}}]}}