Summary
Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux
kernel contained a type-confusion error. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-12351)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-based buffer overflow. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-24490)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-122.124 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | — |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oem | 4.15.0-1100.110 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-52.57 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | — |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | — |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | — |
Vulnerabilities 3
-
Unscored —CVE-2020-12351 Public exploit
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via …
-
Unscored —CVE-2020-12352 Public exploit
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adj…
-
Unscored —CVE-2020-24490 Public exploit
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adj…