{"id":"CVE-2024-38620","state":"PUBLISHED","title":"Bluetooth: HCI: Remove HCI_AMP support","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Remove HCI_AMP support\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev->dev_type altogether.","publishedAt":"2024-06-20T08:03:43.906Z","updatedAt":"2026-08-23T12:45:18.071Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"5af2e235b0d5b797e9531a00c50058319130e156","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"d3c7b012d912b31ad23b9349c0e499d6dddd48ec","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"af1d425b6dc67cd67809f835dd7afb6be4d43e03","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"84a4bb6548a29326564f0e659fb8064503ecc1c7","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmrvl_main.c","drivers/bluetooth/btrsi.c","drivers/bluetooth/btsdio.c","drivers/bluetooth/btusb.c","drivers/bluetooth/hci_bcm4377.c","drivers/bluetooth/hci_ldisc.c","drivers/bluetooth/hci_serdev.c","drivers/bluetooth/hci_uart.h","drivers/bluetooth/hci_vhci.c","drivers/bluetooth/virtio_bt.c","include/net/bluetooth/hci.h","include/net/bluetooth/hci_core.h","include/uapi/linux/virtio_bt.h","net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_event.c","net/bluetooth/hci_sock.c","net/bluetooth/hci_sync.c","net/bluetooth/l2cap_core.c","net/bluetooth/mgmt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.3","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmrvl_main.c","drivers/bluetooth/btrsi.c","drivers/bluetooth/btsdio.c","drivers/bluetooth/btusb.c","drivers/bluetooth/hci_bcm4377.c","drivers/bluetooth/hci_ldisc.c","drivers/bluetooth/hci_serdev.c","drivers/bluetooth/hci_uart.h","drivers/bluetooth/hci_vhci.c","drivers/bluetooth/virtio_bt.c","include/net/bluetooth/hci.h","include/net/bluetooth/hci_core.h","include/uapi/linux/virtio_bt.h","net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_event.c","net/bluetooth/hci_sock.c","net/bluetooth/hci_sync.c","net/bluetooth/l2cap_core.c","net/bluetooth/mgmt.c"]}],"references":["https://git.kernel.org/stable/c/9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2","https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156","https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec","https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03","https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/38xxx/CVE-2024-38620.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-38620","state":"PUBLISHED","datePublished":"2024-06-20T08:03:43.906Z","dateUpdated":"2026-08-23T12:45:18.071Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-06-18T19:36:34.945Z"},"containers":{"cna":{"title":"Bluetooth: HCI: Remove HCI_AMP support","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Remove HCI_AMP support\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev->dev_type altogether."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"5af2e235b0d5b797e9531a00c50058319130e156","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"d3c7b012d912b31ad23b9349c0e499d6dddd48ec","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"af1d425b6dc67cd67809f835dd7afb6be4d43e03","versionType":"git"},{"version":"244bc377591c3882f454882357bc730c90cbedb5","status":"affected","lessThan":"84a4bb6548a29326564f0e659fb8064503ecc1c7","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmrvl_main.c","drivers/bluetooth/btrsi.c","drivers/bluetooth/btsdio.c","drivers/bluetooth/btusb.c","drivers/bluetooth/hci_bcm4377.c","drivers/bluetooth/hci_ldisc.c","drivers/bluetooth/hci_serdev.c","drivers/bluetooth/hci_uart.h","drivers/bluetooth/hci_vhci.c","drivers/bluetooth/virtio_bt.c","include/net/bluetooth/hci.h","include/net/bluetooth/hci_core.h","include/uapi/linux/virtio_bt.h","net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_event.c","net/bluetooth/hci_sock.c","net/bluetooth/hci_sync.c","net/bluetooth/l2cap_core.c","net/bluetooth/mgmt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.3","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/bluetooth/btmrvl_main.c","drivers/bluetooth/btrsi.c","drivers/bluetooth/btsdio.c","drivers/bluetooth/btusb.c","drivers/bluetooth/hci_bcm4377.c","drivers/bluetooth/hci_ldisc.c","drivers/bluetooth/hci_serdev.c","drivers/bluetooth/hci_uart.h","drivers/bluetooth/hci_vhci.c","drivers/bluetooth/virtio_bt.c","include/net/bluetooth/hci.h","include/net/bluetooth/hci_core.h","include/uapi/linux/virtio_bt.h","net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_event.c","net/bluetooth/hci_sock.c","net/bluetooth/hci_sync.c","net/bluetooth/l2cap_core.c","net/bluetooth/mgmt.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/9e6cf0eccfe15b67bf9773ecd101162dfdfed5e2"},{"url":"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156"},{"url":"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec"},{"url":"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03"},{"url":"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The broken paths (`l2cap_recv_acldata`, `l2cap_connect`, `l2cap_connect_cfm`→`l2cap_conn_add`, `hci_queue_acl`, `hci_num_comp_blocks_evt`) all process ACL/L2CAP traffic and link events originating from a remote Bluetooth peer in radio range of an AMP-capable controller, which real hardware ships as (btusb USB class e0/01/04, btmrvl SDIO combo chips, btsdio SDIO_CLASS_BT_AMP, virtio-bt). Bluetooth radio proximity is the adjacent-network vector.\nAC:L - Once an HCI_AMP controller is present — the default state on affected hardware, requiring no attacker setup — the inconsistent paths are reached deterministically by initiating an ACL/L2CAP connection and sending data; there is no race and no memory layout the attacker cannot influence.\nPR:N - An adjacent Bluetooth attacker needs no credentials on the target: `hci_conn_request_evt` and `l2cap_connect_cfm`/`l2cap_conn_add` run before any pairing or authorization, and `l2cap_connect` explicitly exempts the SDP PSM from the link-mode security check.\nUI:N - No victim action is required — inbound connection establishment and ACL data reception are handled autonomously by the kernel once Bluetooth is up.\nS:U - All corruption and crashes stay inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `hci_queue_acl()` builds ACL headers from `chan->handle` rather than `conn->handle` on AMP hdevs, so L2CAP payloads can be emitted tagged with the wrong link handle, and the state corruption in the connection/scheduler bookkeeping is of a class leverageable for kernel memory disclosure.\nI:H - `hci_num_comp_blocks_evt` applies an unbounded `conn->sent -= block_count` to a `hci_chan` that should never have existed, underflowing an unsigned counter that drives `hci_quote_sent`/`hci_low_sent` quota arithmetic, and the ACL handle confusion lets frames be attributed to the wrong connection — kernel state under attacker influence.\nA:H - `__get_blocks()` divides by controller-supplied `hdev->block_len` on the block-based path that only AMP controllers select, giving a divide-by-zero kernel oops; separately, `hci_sched_acl()` never drains the AMP queues so `chan->data_q` grows without bound until memory is exhausted."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:45:18.071Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.6.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.9.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-20T16:21:10.645379Z","id":"CVE-2024-38620","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-20T16:22:30.641Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T04:12:26.064Z"}}]}}}