Is CVE-2024-24859 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-24859 being exploited in the wild.

How severe is CVE-2024-24859?

Medium severity, with a CVSS score of 4.6, published 5 February 2024.

Which products and versions are affected?

Linux Kernel up to 3.19.8, 6.0 to 6.7.2, 6.8-rc1; Siemens SIMATIC S7-1500 TM MFP All versions using affected GNU/Linux subsystem.

Is there a fix for CVE-2024-24859?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-24859 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2024-24859?

Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-24859: Linux Kernel race condition in Bluetooth sniff interval functions

CVE-2024-24859 · Severity: medium · CVSS 4.6 · Published 2024-02-05

A synchronization issue exists in the Bluetooth component of the Linux kernel. This flaw could allow an attacker with high-level access to disrupt Bluetooth services, potentially causing a system crash or service outage. This affects various Linux-based systems, including industrial automation hardware like Siemens SIMATIC controllers.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 TM MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2024-24859 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-24859 being exploited in the wild.
How severe is CVE-2024-24859?: Medium severity, with a CVSS score of 4.6, published 5 February 2024.
Which products and versions are affected?: Linux Kernel up to 3.19.8, 6.0 to 6.7.2, 6.8-rc1; Siemens SIMATIC S7-1500 TM MFP All versions using affected GNU/Linux subsystem.
Is there a fix for CVE-2024-24859?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-24859 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2024-24859?: Check whether you run Linux Kernel or Siemens SIMATIC S7-1500 TM MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition was identified in the net/bluetooth component of the Linux kernel, specifically within the sniff_min_interval_set() and sniff_max_interval_set() functions. The vulnerability stems from improper synchronization during concurrent execution when setting Bluetooth sniff intervals. An attacker with high privileges and adjacent network access could exploit this race condition to trigger a 'sniffing exception,' leading to a denial of service (DoS). The issue affects kernel versions up to 3.19.8 and the 6.x branch up to 6.7.2. Siemens has also confirmed impact on the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP devices.

Affected products

Linux Linux Kernel up to 3.19.8, 6.0 to 6.7.2, 6.8-rc1
Siemens SIMATIC S7-1500 TM MFP All versions using affected GNU/Linux subsystem

Timeline

2024-02-05: disclosed: Initial disclosure of CVE-2024-24859
2024-04-09: advisory: Siemens published advisory SSA-265688 confirming impact on SIMATIC S7-1500 TM MFP

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.