CVE-2024-53144 Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
An attacker can bypass Bluetooth Just Works pairing confirmation requirements, potentially enabling unauthorized device connections without user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53144?
CVE-2024-53144 is a high-severity vulnerability in Linux kernel, published on 17 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just Works") always request user confirmation with confirm_hint set since the likes of bluetoothd have dedicated policy around JUST_WORKS method (e.g. main.conf:JustWorksRepairing).
CVE: CVE-2024-8805
Which versions are affected by CVE-2024-53144?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53144?
Apply the vendor's patch.
Is CVE-2024-53144 being exploited?
There is no known exploitation of CVE-2024-53144 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53144, DEBIAN-CVE-2024-53144, GHSA-hjq7-734v-xhcw, UBUNTU-CVE-2024-53144.