CVE-2024-53144

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

MEDIUM

5.5

CVSS Score

Published: December 17, 2024 at 03:55 PM UTC

Updated: October 15, 2026 at 10:18 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just Works") always request user confirmation with confirm_hint set since the likes of bluetoothd have dedicated policy around JUST_WORKS method (e.g. main.conf:JustWorksRepairing). CVE: CVE-2024-8805

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.10.48 ≤ v < 3.113.12.25 ≤ v < 3.133.14.12 ≤ v < 3.153.15.5 ≤ v < 3.163.16.1 ≤ v < 5.10.2363.2.61 ≤ v < 3.33.4.98 ≤ v < 3.55.11 ≤ v < 5.15.1805.16 ≤ v < 6.1.1136.11 ≤ v < 6.11.36.2 ≤ v < 6.6.556.7 ≤ v < 6.10.143.10.48 3.12.25 3.14.12 3.15.5 3.16 3.16 rc3 3.16 rc4 3.16 rc5 3.16 rc6 3.16 rc7 3.2.61 3.4.98373d1dfcffc63c68184419264a7eaed422c7958e39da39a616103ec7ab8ac351bfb317854e5507c6.12 6.12 rc16ab84785311dc4d0348e6bd4e1c491293b770b98778763287ded64dd5c022435d3e0e3182f148a649a5fcacabde0fe11456f4a1e88072c01846cea25ba15a58b179ed76a7e887177f2b06de12c58ec8fbc96ff59b2f19e924d9e15e24cee19723d674b92

Vendor states this is fixed in 22b49d6e4f399a390c70f3034f5fbacbb9413858 (fixed)

Vendor states this is fixed in 5291ff856d2c5177b4fe9c18828312be30213193 (fixed)

Vendor states this is fixed in 830c03e58beb70b99349760f822e505ecb4eeb7e (fixed)

Vendor states this is fixed in ad7adfb95f64a761e4784381e47bee1a362eb30d (fixed)

Vendor states this is fixed in b25e11f978b63cb7857890edb3a698599cddb10e (fixed)

Vendor states this is fixed in baaa50c6f91ea5a9c7503af51f2bc50e6568b66b (fixed)

Vendor states this is fixed in d17c631ba04e960eb6f8728b10d585de20ac4f71 (fixed)

Affected range stops below 3.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.15, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 3.16 (unaffected)

Affected range stops below 3.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.10.236 (unaffected)

Vendor states this is fixed in 5.15.180 (unaffected)

Vendor states this is fixed in 6.1.113 (unaffected)

Vendor states this is fixed in 6.10.14 (unaffected)

Vendor states this is fixed in 6.11.3 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)

Vendor states this is fixed in 6.6.55 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references