Security readout for executives and security teams
Plain-English summary
CVE-2024-58013 is a Linux kernel Bluetooth memory safety bug. A local authenticated user could trigger a use-after-free in Bluetooth management handling, potentially causing kernel crash or broader compromise. It is rated high because the CVSS vector reports high confidentiality, integrity, and availability impact.
Executive priority
Treat as a high-priority kernel patching item for Linux fleets with Bluetooth enabled or local multi-user access. It is not currently evidenced as actively exploited in the provided sources, but kernel memory corruption with high CVSS impact warrants timely remediation.
Technical view
The issue is CWE-416 in net/bluetooth/mgmt.c, specifically mgmt_remove_adv_monitor_sync. KASAN reported a slab-use-after-free read during Bluetooth management advertising monitor removal, involving pending command cleanup and device close paths. The CVE references multiple Linux stable commits resolving the defect.
Likely exposure
Exposure is most relevant to Linux systems with affected kernels and Bluetooth support enabled or available to local users. The CVSS vector is local, low complexity, low privilege, no user interaction. Confirm exposure against running kernel versions, distribution backports, and Bluetooth configuration.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Evidence supports a local, low-privilege attack surface in the Linux Bluetooth management path, originally demonstrated by a KASAN crash report rather than public weaponization details.
Researcher notes
The provided evidence is strongest on root cause and affected subsystem, but incomplete on exploitability in real deployments. Avoid assuming remote Bluetooth exploitation; the CVSS vector is local. Validate against distro-maintained kernels because version strings may not reflect backported fixes.
Mitigation direction
- Apply Linux kernel or distribution updates that include the referenced stable fixes.
- Check Debian and other vendor advisories for backported fixed kernel package versions.
- Prioritize patching multi-user systems where untrusted users can access Bluetooth interfaces.
- If patching is delayed, review vendor guidance for Bluetooth exposure reduction.
Validation and detection
- Inventory Linux kernel versions and compare them with vendor fixed-version advisories.
- Confirm whether Bluetooth support and management interfaces are enabled on affected hosts.
- Verify installed kernels include the referenced upstream stable commits or distro backports.
- Review local security monitoring for kernel Bluetooth crashes or KASAN-like reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-58013 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/75e65b983c5e2ee51962bfada98a79d805f28827CVE reference, Linux
- https://git.kernel.org/stable/c/4ebbcb9bc794e5be647ee28fdf14eb1ae0659405CVE reference, Linux
- https://git.kernel.org/stable/c/ebb90f23f0ac21044aacf4c61cc5d7841fe99987CVE reference, Linux
- https://git.kernel.org/stable/c/0f3d05aacbfcf3584bbd9caaee34cb02508dab68CVE reference, Linux
- https://git.kernel.org/stable/c/26fbd3494a7dd26269cb0817c289267dbcfdec06CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.