CVE-2024-1638

published 2024-02-19

CVE-2024-1638: The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission…

Priority P3 46 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
linux	linux_kernel	>= 0 < 6.1.119-1	6.1.119-1
linux	linux_kernel	>= 0 < 6.11.7-1	6.11.7-1
zephyrproject-rtos	zephyr	* – 3.5	—
zephyrproject	zephyr	<= 3.5.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20