CVE-2024-20147 — Reachable Assertion in Software Development KIT

CWE-617 — Reachable Assertion3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
2.2%
top 15.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mediatek Software Development KITGoogle AndroidLinuxfoundation Yocto+1 more
Timeline
PublishedFeb 3

Description

In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389046 (Note: For MT79XX chipsets) / ALPS09136501 (Note: For MT2737, MT3603, MT6XXX, and MT8XXX chipsets); Issue ID: MSV-1797.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDgoogle/android13.0, 14.0, 15.0+2
▶NVDopenwrt/openwrt23.05
▶NVDlinuxfoundation/yocto3.3, 4.0, 5.0+2

🔴Vulnerability Details

2
GHSA
GHSA-82mr-cw9v-6p8w: In Bluetooth FW, there is a possible reachable assertion due to improper exception handling↗2025-02-03
▶
CVEList
CVE-2024-20147: In Bluetooth FW, there is a possible reachable assertion due to improper exception handling↗2025-02-03
▶
CVE-2024-20147 — Reachable Assertion | cvebase