Security readout for executives and security teams
Plain-English summary
A flaw in Linux Bluetooth BIG event handling can mishandle an oversized connection handle and release the wrong internal identifier. The supplied CVSS assessment indicates a nearby, unauthenticated attacker could potentially cause limited data compromise and major availability impact. Exposure depends on the running kernel and Bluetooth functionality being enabled and reachable.
Executive priority
Treat as a high-priority patching issue for Bluetooth-enabled Linux systems in publicly accessible, mobile, industrial, or shared environments. Systems without enabled or reachable Bluetooth are likely lower priority. Because availability impact is rated high, expedite validation on operationally critical devices while confirming exact vendor package status.
Technical view
The Linux Bluetooth function hci_le_big_sync_established_evt did not reject handle values within the kernel ID allocator range. Later, hci_conn_cleanup could erroneously release that identifier. The published CVSS 3.1 score is 7.6, with adjacent-network access, low complexity, no privileges, no user interaction, and high availability impact.
Likely exposure
Prioritize Linux devices using affected kernel builds where Bluetooth is enabled, especially systems physically reachable by untrusted Bluetooth devices. The bundle identifies affected versions including 6.7, 6.6.39, 6.9.9, and 6.10, but its version data is unusual; confirm status through the relevant distribution or kernel vendor.
Exploitation context
The supplied record is not marked as CISA KEV and provides no evidence of active exploitation or public weaponization. Its adjacent attack vector means an attacker would generally require Bluetooth proximity. The sources do not describe observed attacks, reliable exploitation conditions, or whether disabling Bluetooth fully mitigates the flaw.
Researcher notes
The defect concerns handle-range validation and erroneous ID allocator release during connection cleanup. The record supplies four stable-tree fixes but no CWE, crash trace, proof of concept, or exploitation telemetry. Exact affected-version interpretation is uncertain because the bundle includes duplicate hashes, an affected version labeled "0," and apparently conflicting branch data.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Check distribution advisories before relying solely on the bundle's unusual version list.
- Disable unnecessary Bluetooth functionality pending updates where operationally acceptable.
- Restrict physical proximity to sensitive Bluetooth-enabled systems when patching is delayed.
Validation and detection
- Inventory running kernel versions and identify systems with Bluetooth enabled.
- Confirm patch status using the Linux distribution's advisory or package changelog.
- Compare custom kernels against the four referenced upstream stable commits.
- After updating, verify the new kernel is active following any required reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42133 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H2.84.7LinuxVulnerability scoring details
Base CVSS 3.1 score
7.6HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a06a8cc80fa203fde828a8429583f7e4fe27eca4CVE reference, Linux
- https://git.kernel.org/stable/c/38263088b845abeeeb98dda5b87c0de3063b6dbbCVE reference, Linux
- https://git.kernel.org/stable/c/dad0003ccc68457baf005a6ed75b4d321463fe3dCVE reference, Linux
- https://git.kernel.org/stable/c/015d79c96d62cd8a4a359fcf5be40d58088c936bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.