CVE-2024-36880: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36880 affects the Linux kernel's Bluetooth QCA driver. The vulnerability was discovered and disclosed on May 30, 2024, and involves missing firmware sanity checks when parsing firmware files before downloading them to Qualcomm Bluetooth devices. This vulnerability affects Linux kernel systems using Qualcomm Bluetooth hardware with the QCA driver (NVD).

The vulnerability exists in the Linux kernel's Bluetooth QCA driver where there were missing sanity checks when parsing firmware files before downloading them to the device. This could lead to accessing and corrupting memory beyond the vmalloced buffer. The issue was introduced in commit 83e81961ff7e ("Bluetooth: btqca: Introduce generic QCA ROME support") and has been fixed by adding proper bounds checking when processing firmware files (Kernel Commit).

If exploited, this vulnerability could allow an attacker to access and corrupt memory beyond the allocated buffer space, potentially leading to system crashes or arbitrary code execution. The vulnerability affects systems using Qualcomm Bluetooth hardware with the QCA driver (NVD).

The vulnerability requires the ability to supply malformed firmware files to the Bluetooth QCA driver. No public exploits have been reported in the wild at the time of assessment (NVD).

The vulnerability has been patched in multiple Linux kernel versions. Ubuntu has released fixes for various kernel versions including 24.04 LTS (6.8.0-40.40), 22.04 LTS (5.15.0-118.128), and other supported releases. Users should update their systems to the patched kernel versions (Ubuntu Security).