Loading story…
CVE-2023-24023 (BLUFFS) affects Bluetooth BR/EDR devices using Secure Simple Pairing or Secure Connections under Bluetooth Core Specification versions 4.2 through 5.4. A nearby man-in-the-middle attacker can force a connection to use a shorter encryption key, potentially recover that key and inject traffic into an active Bluetooth session. Exploitation requires adjacent wireless access; Red Hat assigned a Moderate severity rating of CVSS 6.8.
Red Hat issued kernel and real-time kernel fixes for RHEL 8 and kernel fixes for RHEL 9 through multiple RHSA advisories in April and May 2024. RHEL 9 kernel-rt remained affected at the time of Red Hat’s notice, while RHEL 6 and 7 were outside support scope. Red Hat reported no mitigation that met its requirements for usability, deployment, coverage, and stability, making deployment of applicable kernel updates the primary remediation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:3138 for the RHEL 8 kernel and RHSA-2024:2950 for the RHEL 8 kernel-rt, addressing CVE-2023-24023.
Red Hat released RHSA-2024:2394 to address CVE-2023-24023 (BLUFFS) in the Red Hat Enterprise Linux 9 kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bluetooth.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:4098** to remediate `CVE-2023-2002`, a moderate-severity Linux kernel flaw in the Bluetooth HCI socket implementation. The missing capability check in `net/bluetooth/hci_sock.c` can allow a low-privileged attacker with adjacent Bluetooth-network access to issue unauthorized Bluetooth management commands, potentially affecting the confidentiality, integrity, and availability of Bluetooth communications. The advisory provides kernel version `3.10.0-957.114.1.el7` for Red Hat Enterprise Linux Server AUS 7.6 on x86_64. Red Hat rates the issue CVSS 3.1 **6.8** and classifies it as CWE-250, Execution with Unnecessary Privileges; fixes are also available for affected RHEL 7 and 8 kernel and kernel-rt packages. Administrators should apply applicable prior errata and reboot systems after installing the update, as no generally suitable mitigation is available.
Aug 26, 2026
Red Hat released kernel and real-time kernel updates for supported **Red Hat Enterprise Linux (RHEL) 8 and 9** systems to remediate **CVE-2022-3619**, a Bluetooth L2CAP memory-leak flaw in `l2cap_recv_acldata` within `net/bluetooth/l2cap_core.c`. An adjacent attacker could send malicious Bluetooth packets without privileges or user interaction and potentially exhaust memory or crash an affected host. Red Hat rated the issue moderate severity with a CVSS v3.1 score of 4.3 and classified it as CWE-401. The fixes were included in RHEL 8 kernel version `4.18.0-477.10.1.el8_8` under RHSA-2023:2951 and the real-time kernel version `4.18.0-477.10.1.rt7.274.el8_8` under RHSA-2023:2736, alongside numerous other kernel security corrections affecting virtualization, networking, wireless, USB, and memory safety. Organizations should install the applicable kernel packages and reboot systems; where patching cannot occur promptly, disabling Bluetooth through module blocklisting, hardware controls, or BIOS settings reduces exposure.
Aug 26, 2026
Red Hat released Important kernel updates for **RHEL 7** and **RHEL for Real Time 7** that remediate nine vulnerabilities, including use-after-free, double-free, out-of-bounds-write, information-disclosure, and local privilege-escalation flaws. The fixes include **CVE-2021-3752**, a Bluetooth `lock_sock_nested()` use-after-free condition that a local user could potentially trigger to gain partial privilege escalation. Updated packages are `kernel-3.10.0-1160.59.1.el7` for RHEL 7 and `kernel-rt-3.10.0-1160.59.1.rt56.1200.el7` for the real-time variant, covering supported x86_64, IBM Z, IBM Power, and related RHEL 7 deployments. Administrators should install the updates published in **RHSA-2022:0620** and **RHSA-2022:0622** and reboot affected hosts, as the kernel fixes do not take effect until restart. Red Hat also updated the `3scale-amp2/system-rhel7` container image through **RHBA-2022:0679** to incorporate the RHEL 7 security fixes; 3scale API Management users should upgrade that image and rebuild dependent container images.
Aug 28, 2026