Vulnerability-Lookup

GHSA-GVVJ-7P7C-XPHQ

Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-11-03 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet

This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the valid skb->data.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-56590"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-27T15:15:18Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb-\u003edata.",
  "id": "GHSA-gvvj-7p7c-xphq",
  "modified": "2025-11-03T21:31:53Z",
  "published": "2024-12-27T15:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56590"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/219960a48771b35a3857a491b955c31d6c33d581"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3fe288a8214e7dd784d1f9b7c9e448244d316b47"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/559b1c7ac2e212a23b3833d3baf3bd957771d02e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e50d12cc6e95e1fde08f5db6992b616f714b0fb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/93a6160dc198ffe5786da8bd8588cfd17f53b29a"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-56590 (GCVE-0-2024-56590)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:50 – Updated: 2026-08-05 11:45

Title

Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the valid skb->data.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/219960a48771b35a3…
https://git.kernel.org/stable/c/559b1c7ac2e212a23…
https://git.kernel.org/stable/c/5e50d12cc6e95e1fd…
https://git.kernel.org/stable/c/93a6160dc198ffe57…
https://git.kernel.org/stable/c/3fe288a8214e7dd78…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 219960a48771b35a3857a491b955c31d6c33d581 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 559b1c7ac2e212a23b3833d3baf3bd957771d02e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5e50d12cc6e95e1fde08f5db6992b616f714b0fb (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 93a6160dc198ffe5786da8bd8588cfd17f53b29a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3fe288a8214e7dd784d1f9b7c9e448244d316b47 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:14.000Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "219960a48771b35a3857a491b955c31d6c33d581",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "559b1c7ac2e212a23b3833d3baf3bd957771d02e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5e50d12cc6e95e1fde08f5db6992b616f714b0fb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "93a6160dc198ffe5786da8bd8588cfd17f53b29a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3fe288a8214e7dd784d1f9b7c9e448244d316b47",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb-\u003edata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed short ACL frame enters through the Bluetooth HCI receive path; hci_h5, hci_bcsp, btsdio, btqcomsmd and virtio_bt all hand ACL payloads to hci_recv_frame() with no minimum-length check, so a hostile or RF-compromised controller within wireless range reaches the vulnerable parser. This matches the established treatment of hci_core/hci_event RX-path parsing bugs as Adjacent.\nAC:L - A single ACL frame with a payload shorter than 4 bytes deterministically triggers the unchecked read \u2014 no race, no timing window, and no dependence on memory layout the attacker cannot influence.\nPR:N - hci_acldata_packet() runs on every received ACL frame before any Bluetooth pairing, encryption or L2CAP channel authentication, and the transport-side attacker holds no host account or capability. (The local /dev/vhci and N_HCI ldisc variants require root/CAP_NET_ADMIN in the init namespace, so the unauthenticated transport path is the more severe one.)\nUI:N - Frames are consumed automatically by the hci_rx_work workqueue as soon as the Bluetooth adapter is up; no victim action of any kind is needed.\nS:U - The invalid read and the resulting state corruption are entirely within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:L - Up to two bytes of uninitialized/out-of-bounds heap memory past skb-\u003edata are read into the handle field and disclosed to the kernel log via bt_dev_err(\"ACL packet for unknown connection handle %d\"). The disclosure is real but strictly bounded to a couple of bytes, not an arbitrary read.\nI:L - Because skb_pull() fails silently, the uninitialized handle selects an arbitrary existing hci_conn and the uninitialized flags inject the unstripped header bytes into that unrelated connection\u0027s L2CAP reassembly buffer, discarding or corrupting its pending frame. This is bounded state modification, not an arbitrary write.\nA:H - The bogus ACL_START/ACL_CONT fragments drive l2cap_recv_reset() and l2cap_conn_unreliable(ECOMM) on a victim connection, tearing down an unrelated Bluetooth link, and the attack is repeatable without limit; on KASAN/KMSAN-instrumented or panic-on-warn hardened builds the invalid access is itself fatal."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:12.714Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/219960a48771b35a3857a491b955c31d6c33d581"
        },
        {
          "url": "https://git.kernel.org/stable/c/559b1c7ac2e212a23b3833d3baf3bd957771d02e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e50d12cc6e95e1fde08f5db6992b616f714b0fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/93a6160dc198ffe5786da8bd8588cfd17f53b29a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fe288a8214e7dd784d1f9b7c9e448244d316b47"
        }
      ],
      "title": "Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56590",
    "datePublished": "2024-12-27T14:50:57.854Z",
    "dateReserved": "2024-12-27T14:03:06.002Z",
    "dateUpdated": "2026-08-05T11:45:12.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-GVVJ-7P7C-XPHQ

CVE-2024-56590 (GCVE-0-2024-56590)

Tags

Sightings

Nomenclature

Related by attack behaviour