CVE-2024-38620 Bluetooth: HCI: Remove HCI_AMP support
Removal of unused HCI_AMP support in the Linux kernel Bluetooth subsystem to clean up code and remove obsolete controller types.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38620?
CVE-2024-38620 is a high-severity vulnerability in Linux kernel, published on 20 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: HCI: Remove HCI_AMP support
Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of creating AMP controllers.
Since we no longer need to differentiate between AMP and Primary controllers, as only HCI_PRIMARY is left, this also remove hdev->dev_type altogether.
Which versions are affected by CVE-2024-38620?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38620?
Apply the vendor's patch.
Is CVE-2024-38620 being exploited?
There is no known exploitation of CVE-2024-38620 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-68108, BELL-CVE-2024-38620, DEBIAN-CVE-2024-38620, GHSA-xhv2-gw9c-73rm, ROOT-OS-DEBIAN-11-CVE-2024-38620, ROOT-OS-DEBIAN-12-CVE-2024-38620 and 1 more.