CVE-2024-36033

What it actually does

Missing sanity check on board ID fetch in the Linux Bluetooth QCA driver allows uninitialized slab memory to be copied into a firmware request buffer, resulting in information disclosure of kernel heap contents.

Why it matters to the business

Kernel memory contents containing credentials, keys, or other process data may be exposed to local processes, increasing the risk of credential theft or follow-on attacks on systems running affected kernels; prevalence is high across Linux distributions but exploitability remains low.

How an attack unfolds

An attacker with local access triggers the QCA Bluetooth controller initialization path; the missing bounds check on the board ID response causes the driver to include uninitialized slab data when later requesting firmware, leaking memory to userspace via the firmware loader.

How to fix it

Upgrade the Linux kernel to a version containing commit a3dff121a7f5104c4c2d47edaa2351837ef645dd or later; rebuild and reboot with the patched kernel; apply distribution backports if available for the running release.

How to confirm the fix worked

Confirm the running kernel Git commit or version string includes a3dff121a7f5104c4c2d47edaa2351837ef645dd; inspect the qca_serdev.c source for the added board-ID length validation before the firmware request; re-test device probe with a QCA controller to verify no excess data is returned.

Typical attack path

1. Obtain local execution on a system with a QCA Bluetooth controller
2. Trigger Bluetooth subsystem initialization or device probe
3. Cause the driver to fetch the board ID without the added sanity check
4. Observe leaked slab data returned through the firmware request path

How to detect it

Review kernel logs for unusual firmware request sizes or Bluetooth probe events; examine process memory dumps or strace output showing oversized board-ID responses; no remote network indicators exist.

What your security team should do

• Prioritize kernel updates on all systems exposing Bluetooth hardware within the next maintenance window
• Restrict unprivileged local access where kernel updates cannot be applied immediately
• Monitor vendor advisories for distribution-specific backports of the referenced commit