CVE-2024-36032

HighCVSS 7.1/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: fix info leak when fetching fw build id

Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
Linux	Linux	>= c0187b0bd3e94c48050687d87b2c3c9fbae98ae9, < 62d5550ab62042dcceaf18844d0feadbb962cffe; >= c0187b0bd3e94c48050687d87b2c3c9fbae98ae9, < 57062aa13e87b1a78a4a8f6cb5fab6ba24f5f488; >= c0187b0bd3e94c48050687d87b2c3c9fbae98ae9, < 6b63e0ef4d3ce0080395e5091fba2023f246c45a; >= c0187b0bd3e94c48050687d87b2c3c9fbae98ae9, < a571044cc0a0c944e7c12237b6768aeedd7480e1; >= c0187b0bd3e94c48050687d87b2c3c9fbae98ae9, < cda0d6a198e2a7ec6f176c36173a57bdd8af7af2
Linux	Linux	5.12

References

Timeline

Published: May 30, 2024
Last modified: Aug 4, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-360337.1In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching board id Add the missing s CVE-2024-360348.8Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.CVE-2024-360358.8Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.CVE-2024-360364.2Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and mod CVE-2024-360375.5Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.CVE-2024-360386.3Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy se CVE-2024-360396.3PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.CVE-2024-36048.8The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode CVE-2024-360417.8KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on CVE-2024-360429.8Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthentic CVE-2024-360436.1question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.CVE-2024-360469.8Infoblox NIOS through 8.6.4 executes with more privileges than required.