GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-27416 (GCVE-0-2024-27416)

Vulnerability from cvelistv5 – Published: 2024-05-17 11:51 – Updated: 2026-08-05 11:29
VLAI
Title
Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support SSP since otherwise this event shouldn't be generated.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 15:20 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ccb8618c972f941ebc6b2b9db491025b3369efcb , < afec8f772296dd8e5a2a6f83bbf99db1b9ca877f (git)
Affected: 1769ac55dbf3114d5bf79f11bd5dca80ee263f9c , < 79820a7e1e057120c49be07cbe10643d0706b259 (git)
Affected: 40a33a129d99639921ce00d274cca44ba282f1ac , < df193568d61234c81de7ed4d540c01975de60277 (git)
Affected: 1ef071526848cc3109ade63268854cd7c20ece0c , < c3df637266df29edee85e94cab5fd7041e5753ba (git)
Affected: 25e5d2883002e235f3378b8592aad14aeeef898c , < 30a5e812f78e3d1cced90e1ed750bf027599205f (git)
Affected: c7f59461f5a78994613afc112cdd73688aef9076 , < fba268ac36ab19f9763ff90d276cde0ce6cd5f31 (git)
Affected: c7f59461f5a78994613afc112cdd73688aef9076 , < 8e2758cc25891d2b76717aaf89b40ed215de188c (git)
Affected: c7f59461f5a78994613afc112cdd73688aef9076 , < 7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865 (git)
Affected: 2c7f9fda663a1b31a61744ffc456bdb89c4efc7f (git)
Affected: 746dbb0fc6392eca23de27f8aa9d13979b564889 (git)
Affected: 4.19.297 , < 4.19.309 (semver)
Affected: 5.4.259 , < 5.4.271 (semver)
Affected: 5.10.199 , < 5.10.212 (semver)
Affected: 5.15.137 , < 5.15.151 (semver)
Affected: 6.1.60 , < 6.1.81 (semver)
Affected: 4.14.328 , < 4.15 (semver)
Affected: 6.5.9 , < 6.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 4.19.309 , ≤ 4.19.* (semver)
Unaffected: 5.4.271 , ≤ 5.4.* (semver)
Unaffected: 5.10.212 , ≤ 5.10.* (semver)
Unaffected: 5.15.151 , ≤ 5.15.* (semver)
Unaffected: 6.1.81 , ≤ 6.1.* (semver)
Unaffected: 6.6.21 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27416",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:20:36.979047Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:20:51.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.342Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "afec8f772296dd8e5a2a6f83bbf99db1b9ca877f",
              "status": "affected",
              "version": "ccb8618c972f941ebc6b2b9db491025b3369efcb",
              "versionType": "git"
            },
            {
              "lessThan": "79820a7e1e057120c49be07cbe10643d0706b259",
              "status": "affected",
              "version": "1769ac55dbf3114d5bf79f11bd5dca80ee263f9c",
              "versionType": "git"
            },
            {
              "lessThan": "df193568d61234c81de7ed4d540c01975de60277",
              "status": "affected",
              "version": "40a33a129d99639921ce00d274cca44ba282f1ac",
              "versionType": "git"
            },
            {
              "lessThan": "c3df637266df29edee85e94cab5fd7041e5753ba",
              "status": "affected",
              "version": "1ef071526848cc3109ade63268854cd7c20ece0c",
              "versionType": "git"
            },
            {
              "lessThan": "30a5e812f78e3d1cced90e1ed750bf027599205f",
              "status": "affected",
              "version": "25e5d2883002e235f3378b8592aad14aeeef898c",
              "versionType": "git"
            },
            {
              "lessThan": "fba268ac36ab19f9763ff90d276cde0ce6cd5f31",
              "status": "affected",
              "version": "c7f59461f5a78994613afc112cdd73688aef9076",
              "versionType": "git"
            },
            {
              "lessThan": "8e2758cc25891d2b76717aaf89b40ed215de188c",
              "status": "affected",
              "version": "c7f59461f5a78994613afc112cdd73688aef9076",
              "versionType": "git"
            },
            {
              "lessThan": "7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865",
              "status": "affected",
              "version": "c7f59461f5a78994613afc112cdd73688aef9076",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c7f9fda663a1b31a61744ffc456bdb89c4efc7f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "746dbb0fc6392eca23de27f8aa9d13979b564889",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.309",
              "status": "affected",
              "version": "4.19.297",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.271",
              "status": "affected",
              "version": "5.4.259",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.212",
              "status": "affected",
              "version": "5.10.199",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.151",
              "status": "affected",
              "version": "5.15.137",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.81",
              "status": "affected",
              "version": "6.1.60",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.328",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.309",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.309",
                  "versionStartIncluding": "4.19.297",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.271",
                  "versionStartIncluding": "5.4.259",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.212",
                  "versionStartIncluding": "5.10.199",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.151",
                  "versionStartIncluding": "5.15.137",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.81",
                  "versionStartIncluding": "6.1.60",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.328",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST\n\nIf we received HCI_EV_IO_CAPA_REQUEST while\nHCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote\ndoes support SSP since otherwise this event shouldn\u0027t be generated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable handler processes HCI events generated by a BR/EDR peer that initiates Secure Simple Pairing over an ACL link, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring convention Bluetooth is Adjacent.\nAC:L - The attacker controls its own controller\u0027s LMP timing and simply starts SSP immediately upon connection-complete, which reliably beats the host\u0027s extra Read Remote Extended Features HCI command plus LMP round trip; the attempt can also be repeated without limit.\nPR:N - HCI_EV_IO_CAPA_REQUEST and HCI_EV_SIMPLE_PAIR_COMPLETE are handled during the pre-bonding pairing phase, before any credentials or link key exist, and the guard is hit before even the HCI_MGMT/HCI_BONDABLE policy checks. No privileges on the target are required.\nUI:N - Reaching the code needs only an ACL connection to a connectable or accept-listed host, which is the default steady state for embedded, automotive, audio, kiosk and previously-paired deployments. No victim action is needed to trigger the event sequence.\nS:U - The corrupted state (hci_conn reference count and connection lifetime) lives entirely within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The unbalanced hci_conn_drop() reintroduces a reference-count underflow (CWE-911) on a kernel object, which can drive the connection to teardown while pairing-state-machine work still references it \u2014 a use-after-free class defect whose reclaimed memory can be leveraged for kernel information disclosure.\nI:H - The same refcount underflow lets an attacker-controlled peer desynchronize hci_conn lifetime accounting, and a freed-then-reused hci_conn under remote-influenced heap grooming yields write/control-flow primitives; the guidance treats use-after-free as High integrity impact.\nA:H - A remote peer can reliably stall SSP so pairing never completes, trigger WARN_ON(refcnt \u003c 0) in hci_conn_timeout() (a panic on panic_on_warn builds such as Android and hardened distro kernels), abort a live ACL link prematurely, or leak connections that never time out and exhaust the controller\u0027s ACL slots."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:45.374Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f"
        },
        {
          "url": "https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259"
        },
        {
          "url": "https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865"
        }
      ],
      "title": "Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27416",
    "datePublished": "2024-05-17T11:51:04.270Z",
    "dateReserved": "2024-02-25T13:47:42.682Z",
    "dateUpdated": "2026-08-05T11:29:45.374Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27416",
      "date": "2026-09-16",
      "epss": "0.00356",
      "percentile": "0.29154"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST\\n\\nIf we received HCI_EV_IO_CAPA_REQUEST while\\nHCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote\\ndoes support SSP since otherwise this event shouldn\u0027t be generated.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: Bluetooth: hci_event: Corrige el manejo de HCI_EV_IO_CAPA_REQUEST Si recibimos HCI_EV_IO_CAPA_REQUEST mientras HCI_OP_READ_REMOTE_EXT_FEATURES a\\u00fan no se ha respondido, supongamos que el control remoto admite SSP ya que, de lo contrario, este evento no deber\\u00eda generarse.\"}]",
      "id": "CVE-2024-27416",
      "lastModified": "2024-11-21T09:04:34.783",
      "published": "2024-05-17T12:15:13.070",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27416\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T12:15:13.070\",\"lastModified\":\"2026-08-04T11:17:48.977\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST\\n\\nIf we received HCI_EV_IO_CAPA_REQUEST while\\nHCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote\\ndoes support SSP since otherwise this event shouldn\u0027t be generated.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: Bluetooth: hci_event: Corrige el manejo de HCI_EV_IO_CAPA_REQUEST Si recibimos HCI_EV_IO_CAPA_REQUEST mientras HCI_OP_READ_REMOTE_EXT_FEATURES a\u00fan no se ha respondido, supongamos que el control remoto admite SSP ya que, de lo contrario, este evento no deber\u00eda generarse.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ccb8618c972f941ebc6b2b9db491025b3369efcb\",\"lessThan\":\"afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1769ac55dbf3114d5bf79f11bd5dca80ee263f9c\",\"lessThan\":\"79820a7e1e057120c49be07cbe10643d0706b259\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"40a33a129d99639921ce00d274cca44ba282f1ac\",\"lessThan\":\"df193568d61234c81de7ed4d540c01975de60277\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1ef071526848cc3109ade63268854cd7c20ece0c\",\"lessThan\":\"c3df637266df29edee85e94cab5fd7041e5753ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"25e5d2883002e235f3378b8592aad14aeeef898c\",\"lessThan\":\"30a5e812f78e3d1cced90e1ed750bf027599205f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c7f59461f5a78994613afc112cdd73688aef9076\",\"lessThan\":\"fba268ac36ab19f9763ff90d276cde0ce6cd5f31\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c7f59461f5a78994613afc112cdd73688aef9076\",\"lessThan\":\"8e2758cc25891d2b76717aaf89b40ed215de188c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c7f59461f5a78994613afc112cdd73688aef9076\",\"lessThan\":\"7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2c7f9fda663a1b31a61744ffc456bdb89c4efc7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"746dbb0fc6392eca23de27f8aa9d13979b564889\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.297\",\"lessThan\":\"4.19.309\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.259\",\"lessThan\":\"5.4.271\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.199\",\"lessThan\":\"5.10.212\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.137\",\"lessThan\":\"5.15.151\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.60\",\"lessThan\":\"6.1.81\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.328\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.5.9\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.309\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.271\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.212\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.151\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.81\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.21\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.9\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T15:20:36.979047Z\",\"id\":\"CVE-2024-27416\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.328\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"1ECB0106-30FC-4AED-AF86-853B9D63803B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.297\",\"versionEndExcluding\":\"4.19.309\",\"matchCriteriaId\":\"8BEBCD21-9B3B-47B8-AAA0-7B2CEBC7A590\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.259\",\"versionEndExcluding\":\"5.4.271\",\"matchCriteriaId\":\"1D45322E-A953-46A1-981D-72056DA4F758\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.199\",\"versionEndExcluding\":\"5.10.212\",\"matchCriteriaId\":\"FC6F5280-149D-4926-A836-7D310BD55522\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.137\",\"versionEndExcluding\":\"5.15.151\",\"matchCriteriaId\":\"63DBC536-F753-497B-8F0C-CEC6E3FD2CFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.60\",\"versionEndExcluding\":\"6.1.81\",\"matchCriteriaId\":\"57EE177D-296D-40B2-9DE0-28D8274A8ABA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.9\",\"versionEndExcluding\":\"6.6\",\"matchCriteriaId\":\"9AC54E1F-8CEA-4349-9973-283781371BE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.1\",\"versionEndExcluding\":\"6.6.21\",\"matchCriteriaId\":\"0B8D3A4B-82AB-4D66-ABA6-64027960F7B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.9\",\"matchCriteriaId\":\"1C538467-EDA0-4A9A-82EB-2925DE9FF827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E346B162-D566-4E62-ABDE-ECBFB21B8BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC5BD782-474C-4A68-AED7-6EC818FF89AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T17:06:55+00:00",
      "cve": "CVE-2024-27416",
      "id": "CVE-2024-27416",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27416.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:25:19Z",
      "cve": "CVE-2024-27416",
      "id": "CVE-2024-27416",
      "initial_release_date": "2024-05-21T02:00:42Z",
      "product_status:known_affected": "368",
      "product_status:known_not_affected": "217",
      "product_status:recommended": "670",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27416",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27416.json",
      "version": "91"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.342Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27416\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:20:36.979047Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:20:44.286Z\"}}], \"cna\": {\"title\": \"Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable handler processes HCI events generated by a BR/EDR peer that initiates Secure Simple Pairing over an ACL link, so the attacker must be within Bluetooth radio range of the target. Per kernel scoring convention Bluetooth is Adjacent.\\nAC:L - The attacker controls its own controller\u0027s LMP timing and simply starts SSP immediately upon connection-complete, which reliably beats the host\u0027s extra Read Remote Extended Features HCI command plus LMP round trip; the attempt can also be repeated without limit.\\nPR:N - HCI_EV_IO_CAPA_REQUEST and HCI_EV_SIMPLE_PAIR_COMPLETE are handled during the pre-bonding pairing phase, before any credentials or link key exist, and the guard is hit before even the HCI_MGMT/HCI_BONDABLE policy checks. No privileges on the target are required.\\nUI:N - Reaching the code needs only an ACL connection to a connectable or accept-listed host, which is the default steady state for embedded, automotive, audio, kiosk and previously-paired deployments. No victim action is needed to trigger the event sequence.\\nS:U - The corrupted state (hci_conn reference count and connection lifetime) lives entirely within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\\nC:H - The unbalanced hci_conn_drop() reintroduces a reference-count underflow (CWE-911) on a kernel object, which can drive the connection to teardown while pairing-state-machine work still references it \\u2014 a use-after-free class defect whose reclaimed memory can be leveraged for kernel information disclosure.\\nI:H - The same refcount underflow lets an attacker-controlled peer desynchronize hci_conn lifetime accounting, and a freed-then-reused hci_conn under remote-influenced heap grooming yields write/control-flow primitives; the guidance treats use-after-free as High integrity impact.\\nA:H - A remote peer can reliably stall SSP so pairing never completes, trigger WARN_ON(refcnt \u003c 0) in hci_conn_timeout() (a panic on panic_on_warn builds such as Android and hardened distro kernels), abort a live ACL link prematurely, or leak connections that never time out and exhaust the controller\u0027s ACL slots.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ccb8618c972f941ebc6b2b9db491025b3369efcb\", \"lessThan\": \"afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1769ac55dbf3114d5bf79f11bd5dca80ee263f9c\", \"lessThan\": \"79820a7e1e057120c49be07cbe10643d0706b259\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"40a33a129d99639921ce00d274cca44ba282f1ac\", \"lessThan\": \"df193568d61234c81de7ed4d540c01975de60277\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1ef071526848cc3109ade63268854cd7c20ece0c\", \"lessThan\": \"c3df637266df29edee85e94cab5fd7041e5753ba\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"25e5d2883002e235f3378b8592aad14aeeef898c\", \"lessThan\": \"30a5e812f78e3d1cced90e1ed750bf027599205f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c7f59461f5a78994613afc112cdd73688aef9076\", \"lessThan\": \"fba268ac36ab19f9763ff90d276cde0ce6cd5f31\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c7f59461f5a78994613afc112cdd73688aef9076\", \"lessThan\": \"8e2758cc25891d2b76717aaf89b40ed215de188c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c7f59461f5a78994613afc112cdd73688aef9076\", \"lessThan\": \"7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2c7f9fda663a1b31a61744ffc456bdb89c4efc7f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"746dbb0fc6392eca23de27f8aa9d13979b564889\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.297\", \"lessThan\": \"4.19.309\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.259\", \"lessThan\": \"5.4.271\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.199\", \"lessThan\": \"5.10.212\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.137\", \"lessThan\": \"5.15.151\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.60\", \"lessThan\": \"6.1.81\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.328\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.5.9\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bluetooth/hci_event.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.309\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.271\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.212\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.151\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.81\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bluetooth/hci_event.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/afec8f772296dd8e5a2a6f83bbf99db1b9ca877f\"}, {\"url\": \"https://git.kernel.org/stable/c/79820a7e1e057120c49be07cbe10643d0706b259\"}, {\"url\": \"https://git.kernel.org/stable/c/df193568d61234c81de7ed4d540c01975de60277\"}, {\"url\": \"https://git.kernel.org/stable/c/c3df637266df29edee85e94cab5fd7041e5753ba\"}, {\"url\": \"https://git.kernel.org/stable/c/30a5e812f78e3d1cced90e1ed750bf027599205f\"}, {\"url\": \"https://git.kernel.org/stable/c/fba268ac36ab19f9763ff90d276cde0ce6cd5f31\"}, {\"url\": \"https://git.kernel.org/stable/c/8e2758cc25891d2b76717aaf89b40ed215de188c\"}, {\"url\": \"https://git.kernel.org/stable/c/7e74aa53a68bf60f6019bd5d9a9a1406ec4d4865\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST\\n\\nIf we received HCI_EV_IO_CAPA_REQUEST while\\nHCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote\\ndoes support SSP since otherwise this event shouldn\u0027t be generated.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.309\", \"versionStartIncluding\": \"4.19.297\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.271\", \"versionStartIncluding\": \"5.4.259\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.212\", \"versionStartIncluding\": \"5.10.199\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.151\", \"versionStartIncluding\": \"5.15.137\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.81\", \"versionStartIncluding\": \"6.1.60\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.21\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.9\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.328\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.5.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:45.374Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27416\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:45.374Z\", \"dateReserved\": \"2024-02-25T13:47:42.682Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T11:51:04.270Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.