CVE-2024-36033

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: fix info leak when fetching board id

Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
Linux	Linux	>= c3c1bd421db6187ee455995bfbf1ba16d98f5e6b, < a3dff121a7f5104c4c2d47edaa2351837ef645dd; >= ad643241d455fdd2516d46cfa54bd0c5e504fc86, < bcccdc947d2ca5972b1e92d0dea10803ddc08ceb; >= a381ee26d7c70dbc048cd17c4e0f40619118ff1f, < ba307abed5e09759845c735ba036f8c12f55b209; >= a7f8dedb4be2cc930a29af24427b885405ecd15d, < f30c37cb4549baf8377434892d520fe7769bdba7; >= a7f8dedb4be2cc930a29af24427b885405ecd15d, < 0adcf6be1445ed50bfd4a451a7a782568f270197
Linux	Linux	6.7

References

Timeline

Published: May 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-360348.8Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.CVE-2024-360358.8Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.CVE-2024-360364.2Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and mod CVE-2024-360375.5Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings.CVE-2024-360386.3Zoho ManageEngine ITOM products versions from 128234 to 128248 are affected by the stored cross-site scripting vulnerability in the proxy se CVE-2024-360396.3PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.CVE-2024-36048.8The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode CVE-2024-360417.8KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on CVE-2024-360429.8Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthentic CVE-2024-360436.1question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.CVE-2024-360469.8Infoblox NIOS through 8.6.4 executes with more privileges than required.CVE-2024-360479.8Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.