CVE-2024-38620 (GCVE-0-2024-38620)

Vulnerability from cvelistv5 – Published: 2024-06-20 08:03 – Updated: 2026-08-05 11:33
VLAI
Title
Bluetooth: HCI: Remove HCI_AMP support
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of creating AMP controllers. Since we no longer need to differentiate between AMP and Primary controllers, as only HCI_PRIMARY is left, this also remove hdev->dev_type altogether.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 244bc377591c3882f454882357bc730c90cbedb5 , < 5af2e235b0d5b797e9531a00c50058319130e156 (git)
Affected: 244bc377591c3882f454882357bc730c90cbedb5 , < d3c7b012d912b31ad23b9349c0e499d6dddd48ec (git)
Affected: 244bc377591c3882f454882357bc730c90cbedb5 , < af1d425b6dc67cd67809f835dd7afb6be4d43e03 (git)
Affected: 244bc377591c3882f454882357bc730c90cbedb5 , < 84a4bb6548a29326564f0e659fb8064503ecc1c7 (git)
Create a notification for this product.
Linux Linux Affected: 4.3
Unaffected: 0 , < 4.3 (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38620",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T16:21:10.645379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T16:22:30.641Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btmrvl_main.c",
            "drivers/bluetooth/btrsi.c",
            "drivers/bluetooth/btsdio.c",
            "drivers/bluetooth/btusb.c",
            "drivers/bluetooth/hci_bcm4377.c",
            "drivers/bluetooth/hci_ldisc.c",
            "drivers/bluetooth/hci_serdev.c",
            "drivers/bluetooth/hci_uart.h",
            "drivers/bluetooth/hci_vhci.c",
            "drivers/bluetooth/virtio_bt.c",
            "include/net/bluetooth/hci.h",
            "include/net/bluetooth/hci_core.h",
            "include/uapi/linux/virtio_bt.h",
            "net/bluetooth/hci_conn.c",
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_event.c",
            "net/bluetooth/hci_sock.c",
            "net/bluetooth/hci_sync.c",
            "net/bluetooth/l2cap_core.c",
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5af2e235b0d5b797e9531a00c50058319130e156",
              "status": "affected",
              "version": "244bc377591c3882f454882357bc730c90cbedb5",
              "versionType": "git"
            },
            {
              "lessThan": "d3c7b012d912b31ad23b9349c0e499d6dddd48ec",
              "status": "affected",
              "version": "244bc377591c3882f454882357bc730c90cbedb5",
              "versionType": "git"
            },
            {
              "lessThan": "af1d425b6dc67cd67809f835dd7afb6be4d43e03",
              "status": "affected",
              "version": "244bc377591c3882f454882357bc730c90cbedb5",
              "versionType": "git"
            },
            {
              "lessThan": "84a4bb6548a29326564f0e659fb8064503ecc1c7",
              "status": "affected",
              "version": "244bc377591c3882f454882357bc730c90cbedb5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btmrvl_main.c",
            "drivers/bluetooth/btrsi.c",
            "drivers/bluetooth/btsdio.c",
            "drivers/bluetooth/btusb.c",
            "drivers/bluetooth/hci_bcm4377.c",
            "drivers/bluetooth/hci_ldisc.c",
            "drivers/bluetooth/hci_serdev.c",
            "drivers/bluetooth/hci_uart.h",
            "drivers/bluetooth/hci_vhci.c",
            "drivers/bluetooth/virtio_bt.c",
            "include/net/bluetooth/hci.h",
            "include/net/bluetooth/hci_core.h",
            "include/uapi/linux/virtio_bt.h",
            "net/bluetooth/hci_conn.c",
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_event.c",
            "net/bluetooth/hci_sock.c",
            "net/bluetooth/hci_sync.c",
            "net/bluetooth/l2cap_core.c",
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Remove HCI_AMP support\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev-\u003edev_type altogether."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The broken paths (`l2cap_recv_acldata`, `l2cap_connect`, `l2cap_connect_cfm`\u2192`l2cap_conn_add`, `hci_queue_acl`, `hci_num_comp_blocks_evt`) all process ACL/L2CAP traffic and link events originating from a remote Bluetooth peer in radio range of an AMP-capable controller, which real hardware ships as (btusb USB class e0/01/04, btmrvl SDIO combo chips, btsdio SDIO_CLASS_BT_AMP, virtio-bt). Bluetooth radio proximity is the adjacent-network vector.\nAC:L - Once an HCI_AMP controller is present \u2014 the default state on affected hardware, requiring no attacker setup \u2014 the inconsistent paths are reached deterministically by initiating an ACL/L2CAP connection and sending data; there is no race and no memory layout the attacker cannot influence.\nPR:N - An adjacent Bluetooth attacker needs no credentials on the target: `hci_conn_request_evt` and `l2cap_connect_cfm`/`l2cap_conn_add` run before any pairing or authorization, and `l2cap_connect` explicitly exempts the SDP PSM from the link-mode security check.\nUI:N - No victim action is required \u2014 inbound connection establishment and ACL data reception are handled autonomously by the kernel once Bluetooth is up.\nS:U - All corruption and crashes stay inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `hci_queue_acl()` builds ACL headers from `chan-\u003ehandle` rather than `conn-\u003ehandle` on AMP hdevs, so L2CAP payloads can be emitted tagged with the wrong link handle, and the state corruption in the connection/scheduler bookkeeping is of a class leverageable for kernel memory disclosure.\nI:H - `hci_num_comp_blocks_evt` applies an unbounded `conn-\u003esent -= block_count` to a `hci_chan` that should never have existed, underflowing an unsigned counter that drives `hci_quote_sent`/`hci_low_sent` quota arithmetic, and the ACL handle confusion lets frames be attributed to the wrong connection \u2014 kernel state under attacker influence.\nA:H - `__get_blocks()` divides by controller-supplied `hdev-\u003eblock_len` on the block-based path that only AMP controllers select, giving a divide-by-zero kernel oops; separately, `hci_sched_acl()` never drains the AMP queues so `chan-\u003edata_q` grows without bound until memory is exhausted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:13.520Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03"
        },
        {
          "url": "https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7"
        }
      ],
      "title": "Bluetooth: HCI: Remove HCI_AMP support",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38620",
    "datePublished": "2024-06-20T08:03:43.906Z",
    "dateReserved": "2024-06-18T19:36:34.945Z",
    "dateUpdated": "2026-08-05T11:33:13.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38620",
      "date": "2026-08-07",
      "epss": "0.0031",
      "percentile": "0.23344"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: HCI: Remove HCI_AMP support\\n\\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\\nremove it along with the capability of creating AMP controllers.\\n\\nSince we no longer need to differentiate between AMP and Primary\\ncontrollers, as only HCI_PRIMARY is left, this also remove\\nhdev-\u003edev_type altogether.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: Bluetooth: HCI: eliminar la compatibilidad con HCI_AMP Dado que se elimin\\u00f3 BT_HS, los controladores HCI_AMP ya no tienen ning\\u00fan uso, as\\u00ed que elim\\u00ednelos junto con la capacidad de crear controladores AMP. Como ya no necesitamos diferenciar entre los controladores AMP y primarios, ya que solo queda HCI_PRIMARY, esto tambi\\u00e9n elimina hdev-\u0026gt;dev_type por completo.\"}]",
      "id": "CVE-2024-38620",
      "lastModified": "2024-11-21T09:26:30.370",
      "published": "2024-06-20T08:15:38.377",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:17:59.000Z",
      "cve": "CVE-2024-38620",
      "id": "msrc_CVE-2024-38620",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: HCI: Remove HCI_AMP support",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-38620.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38620\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-20T08:15:38.377\",\"lastModified\":\"2026-08-04T11:18:52.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: HCI: Remove HCI_AMP support\\n\\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\\nremove it along with the capability of creating AMP controllers.\\n\\nSince we no longer need to differentiate between AMP and Primary\\ncontrollers, as only HCI_PRIMARY is left, this also remove\\nhdev-\u003edev_type altogether.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Bluetooth: HCI: eliminar la compatibilidad con HCI_AMP Dado que se elimin\u00f3 BT_HS, los controladores HCI_AMP ya no tienen ning\u00fan uso, as\u00ed que elim\u00ednelos junto con la capacidad de crear controladores AMP. Como ya no necesitamos diferenciar entre los controladores AMP y primarios, ya que solo queda HCI_PRIMARY, esto tambi\u00e9n elimina hdev-\u0026gt;dev_type por completo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/bluetooth/btmrvl_main.c\",\"drivers/bluetooth/btrsi.c\",\"drivers/bluetooth/btsdio.c\",\"drivers/bluetooth/btusb.c\",\"drivers/bluetooth/hci_bcm4377.c\",\"drivers/bluetooth/hci_ldisc.c\",\"drivers/bluetooth/hci_serdev.c\",\"drivers/bluetooth/hci_uart.h\",\"drivers/bluetooth/hci_vhci.c\",\"drivers/bluetooth/virtio_bt.c\",\"include/net/bluetooth/hci.h\",\"include/net/bluetooth/hci_core.h\",\"include/uapi/linux/virtio_bt.h\",\"net/bluetooth/hci_conn.c\",\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_event.c\",\"net/bluetooth/hci_sock.c\",\"net/bluetooth/hci_sync.c\",\"net/bluetooth/l2cap_core.c\",\"net/bluetooth/mgmt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"244bc377591c3882f454882357bc730c90cbedb5\",\"lessThan\":\"5af2e235b0d5b797e9531a00c50058319130e156\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"244bc377591c3882f454882357bc730c90cbedb5\",\"lessThan\":\"d3c7b012d912b31ad23b9349c0e499d6dddd48ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"244bc377591c3882f454882357bc730c90cbedb5\",\"lessThan\":\"af1d425b6dc67cd67809f835dd7afb6be4d43e03\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"244bc377591c3882f454882357bc730c90cbedb5\",\"lessThan\":\"84a4bb6548a29326564f0e659fb8064503ecc1c7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/bluetooth/btmrvl_main.c\",\"drivers/bluetooth/btrsi.c\",\"drivers/bluetooth/btsdio.c\",\"drivers/bluetooth/btusb.c\",\"drivers/bluetooth/hci_bcm4377.c\",\"drivers/bluetooth/hci_ldisc.c\",\"drivers/bluetooth/hci_serdev.c\",\"drivers/bluetooth/hci_uart.h\",\"drivers/bluetooth/hci_vhci.c\",\"drivers/bluetooth/virtio_bt.c\",\"include/net/bluetooth/hci.h\",\"include/net/bluetooth/hci_core.h\",\"include/uapi/linux/virtio_bt.h\",\"net/bluetooth/hci_conn.c\",\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_event.c\",\"net/bluetooth/hci_sock.c\",\"net/bluetooth/hci_sync.c\",\"net/bluetooth/l2cap_core.c\",\"net/bluetooth/mgmt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-20T16:21:10.645379Z\",\"id\":\"CVE-2024-38620\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.3\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"69FDB5EB-450C-44B2-882E-8B68A401BA09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:44:36+00:00",
      "cve": "CVE-2024-38620",
      "id": "CVE-2024-38620",
      "initial_release_date": "2024-06-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: HCI: Remove HCI_AMP support",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38620.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:56:52Z",
      "cve": "CVE-2024-38620",
      "id": "CVE-2024-38620",
      "initial_release_date": "2024-06-24T23:15:35Z",
      "product_status:known_not_affected": "523",
      "product_status:recommended": "59",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-38620",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38620.json",
      "version": "40"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:26.064Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38620\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-20T16:21:10.645379Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-20T16:22:27.372Z\"}}], \"cna\": {\"title\": \"Bluetooth: HCI: Remove HCI_AMP support\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The broken paths (`l2cap_recv_acldata`, `l2cap_connect`, `l2cap_connect_cfm`\\u2192`l2cap_conn_add`, `hci_queue_acl`, `hci_num_comp_blocks_evt`) all process ACL/L2CAP traffic and link events originating from a remote Bluetooth peer in radio range of an AMP-capable controller, which real hardware ships as (btusb USB class e0/01/04, btmrvl SDIO combo chips, btsdio SDIO_CLASS_BT_AMP, virtio-bt). Bluetooth radio proximity is the adjacent-network vector.\\nAC:L - Once an HCI_AMP controller is present \\u2014 the default state on affected hardware, requiring no attacker setup \\u2014 the inconsistent paths are reached deterministically by initiating an ACL/L2CAP connection and sending data; there is no race and no memory layout the attacker cannot influence.\\nPR:N - An adjacent Bluetooth attacker needs no credentials on the target: `hci_conn_request_evt` and `l2cap_connect_cfm`/`l2cap_conn_add` run before any pairing or authorization, and `l2cap_connect` explicitly exempts the SDP PSM from the link-mode security check.\\nUI:N - No victim action is required \\u2014 inbound connection establishment and ACL data reception are handled autonomously by the kernel once Bluetooth is up.\\nS:U - All corruption and crashes stay inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `hci_queue_acl()` builds ACL headers from `chan-\u003ehandle` rather than `conn-\u003ehandle` on AMP hdevs, so L2CAP payloads can be emitted tagged with the wrong link handle, and the state corruption in the connection/scheduler bookkeeping is of a class leverageable for kernel memory disclosure.\\nI:H - `hci_num_comp_blocks_evt` applies an unbounded `conn-\u003esent -= block_count` to a `hci_chan` that should never have existed, underflowing an unsigned counter that drives `hci_quote_sent`/`hci_low_sent` quota arithmetic, and the ACL handle confusion lets frames be attributed to the wrong connection \\u2014 kernel state under attacker influence.\\nA:H - `__get_blocks()` divides by controller-supplied `hdev-\u003eblock_len` on the block-based path that only AMP controllers select, giving a divide-by-zero kernel oops; separately, `hci_sched_acl()` never drains the AMP queues so `chan-\u003edata_q` grows without bound until memory is exhausted.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"244bc377591c3882f454882357bc730c90cbedb5\", \"lessThan\": \"5af2e235b0d5b797e9531a00c50058319130e156\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"244bc377591c3882f454882357bc730c90cbedb5\", \"lessThan\": \"d3c7b012d912b31ad23b9349c0e499d6dddd48ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"244bc377591c3882f454882357bc730c90cbedb5\", \"lessThan\": \"af1d425b6dc67cd67809f835dd7afb6be4d43e03\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"244bc377591c3882f454882357bc730c90cbedb5\", \"lessThan\": \"84a4bb6548a29326564f0e659fb8064503ecc1c7\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/bluetooth/btmrvl_main.c\", \"drivers/bluetooth/btrsi.c\", \"drivers/bluetooth/btsdio.c\", \"drivers/bluetooth/btusb.c\", \"drivers/bluetooth/hci_bcm4377.c\", \"drivers/bluetooth/hci_ldisc.c\", \"drivers/bluetooth/hci_serdev.c\", \"drivers/bluetooth/hci_uart.h\", \"drivers/bluetooth/hci_vhci.c\", \"drivers/bluetooth/virtio_bt.c\", \"include/net/bluetooth/hci.h\", \"include/net/bluetooth/hci_core.h\", \"include/uapi/linux/virtio_bt.h\", \"net/bluetooth/hci_conn.c\", \"net/bluetooth/hci_core.c\", \"net/bluetooth/hci_event.c\", \"net/bluetooth/hci_sock.c\", \"net/bluetooth/hci_sync.c\", \"net/bluetooth/l2cap_core.c\", \"net/bluetooth/mgmt.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/bluetooth/btmrvl_main.c\", \"drivers/bluetooth/btrsi.c\", \"drivers/bluetooth/btsdio.c\", \"drivers/bluetooth/btusb.c\", \"drivers/bluetooth/hci_bcm4377.c\", \"drivers/bluetooth/hci_ldisc.c\", \"drivers/bluetooth/hci_serdev.c\", \"drivers/bluetooth/hci_uart.h\", \"drivers/bluetooth/hci_vhci.c\", \"drivers/bluetooth/virtio_bt.c\", \"include/net/bluetooth/hci.h\", \"include/net/bluetooth/hci_core.h\", \"include/uapi/linux/virtio_bt.h\", \"net/bluetooth/hci_conn.c\", \"net/bluetooth/hci_core.c\", \"net/bluetooth/hci_event.c\", \"net/bluetooth/hci_sock.c\", \"net/bluetooth/hci_sync.c\", \"net/bluetooth/l2cap_core.c\", \"net/bluetooth/mgmt.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156\"}, {\"url\": \"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec\"}, {\"url\": \"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03\"}, {\"url\": \"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: HCI: Remove HCI_AMP support\\n\\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\\nremove it along with the capability of creating AMP controllers.\\n\\nSince we no longer need to differentiate between AMP and Primary\\ncontrollers, as only HCI_PRIMARY is left, this also remove\\nhdev-\u003edev_type altogether.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"4.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"4.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"4.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:33:13.520Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38620\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:33:13.520Z\", \"dateReserved\": \"2024-06-18T19:36:34.945Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-20T08:03:43.906Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.