CVE-2024-36032

What it actually does

The vulnerability allows leakage of uninitialized stack memory containing up to 255 bytes of kernel data through a debugfs interface when a malformed Bluetooth firmware build-info reply is processed by the qca driver.

Why it matters to the business

Attackers may obtain sensitive kernel memory contents that could contain credentials, addresses, or other data useful for escalating attacks on Linux systems, increasing overall exposure especially in environments with many devices running affected kernels.

How an attack unfolds

An attacker with local access or the ability to influence Bluetooth firmware responses triggers the qca build-info fetch path, supplies a malformed reply, and reads the resulting debugfs output to capture leaked stack data; no named threat actors are confirmed exploiting this specific issue.

How to fix it

Update the Linux kernel to the fixed commit 62d5550ab62042dcceaf18844d0feadbb962cffe or later stable releases that include the sanity checks and heap allocation for the build-id buffer.

How to confirm the fix worked

Verify the running kernel contains commit 62d5550ab62042dcceaf18844d0feadbb962cffe, inspect the qca debugfs code for the added length checks and kzalloc usage instead of stack allocation, and confirm no excessive data is returned for crafted build-info replies.

Typical attack path

1. Gain local access or control over Bluetooth firmware responses on a target Linux system
2. Trigger the firmware build-info retrieval via debugfs or related Bluetooth operations
3. Supply a malformed reply lacking proper length or sanity values
4. Read the exposed debugfs file to extract up to 255 bytes of stack memory
5. Use leaked data such as pointers or credentials to advance further exploitation

How to detect it

Examine system logs and debugfs access patterns for unexpected reads of qca build-info files, correlate with Bluetooth firmware interaction events, and look for processes querying debugfs shortly before anomalous memory disclosures or follow-on exploits.

What your security team should do

• Prioritize kernel upgrades to the fixed version across all affected Linux distributions and embedded devices
• Disable unnecessary debugfs exposure for Bluetooth components until patched
• Monitor upstream stable kernel releases for backports of the fix
• Review Bluetooth debugfs usage in production environments for least-privilege access