01 Record

CVE-2024-53144

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.41% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 35.9% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-12-17 15:55Z1 YR AGO

Last updated

2026-10-15 21:41Z13 DAYS AGO

Reserved

2024-11-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20Improper Input ValidationClass

Data version

5.2

Document digest

f563754aac6ba121e7452e131acec3ec98c92c9ec3dd52efa8c27489525ba7aa

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxba15a58b179ed76a7e887177f2b06de12c58ec8f to < baaa50c6f91ea5a9c7503af51f2bc50e6568b66b, ba15a58b179ed76a7e887177f2b06de12c58ec8f to < 22b49d6e4f399a390c70f3034f5fbacbb9413858, ba15a58b179ed76a7e887177f2b06de12c58ec8f to < d17c631ba04e960eb6f8728b10d585de20ac4f71, ba15a58b179ed76a7e887177f2b06de12c58ec8f to < 830c03e58beb70b99349760f822e505ecb4eeb7e, ba15a58b179ed76a7e887177f2b06de12c58ec8f to < ad7adfb95f64a761e4784381e47bee1a362eb30d, ba15a58b179ed76a7e887177f2b06de12c58ec8f to < 5291ff856d2c5177b4fe9c18828312be30213193, ba15a58b179ed76a7e887177f2b06de12c58ec8f to < b25e11f978b63cb7857890edb3a698599cddb10e, 373d1dfcffc63c68184419264a7eaed422c7958e, bc96ff59b2f19e924d9e15e24cee19723d674b92, 6ab84785311dc4d0348e6bd4e1c491293b770b98, 778763287ded64dd5c022435d3e0e3182f148a64, 9a5fcacabde0fe11456f4a1e88072c01846cea25, 039da39a616103ec7ab8ac351bfb317854e5507c, 3.2.61 to < 3.3, 3.4.98 to < 3.5, 3.10.48 to < 3.11, 3.12.25 to < 3.13, 3.14.12 to < 3.15, 3.15.5 to < 3.16, 3.16—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/baaa50c6f91ea5a9c7503af51f2bc50e6568b66b
git.kernel.orghttps://git.kernel.org/stable/c/22b49d6e4f399a390c70f3034f5fbacbb9413858
git.kernel.orghttps://git.kernel.org/stable/c/d17c631ba04e960eb6f8728b10d585de20ac4f71
git.kernel.orghttps://git.kernel.org/stable/c/830c03e58beb70b99349760f822e505ecb4eeb7e
git.kernel.orghttps://git.kernel.org/stable/c/ad7adfb95f64a761e4784381e47bee1a362eb30d
git.kernel.orghttps://git.kernel.org/stable/c/5291ff856d2c5177b4fe9c18828312be30213193
git.kernel.orghttps://git.kernel.org/stable/c/b25e11f978b63cb7857890edb3a698599cddb10e
www.zerodayinitiative.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1229/
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.115-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.11.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.11.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.