Summary
Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux
kernel contained a type-confusion error. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-12351)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-based buffer overflow. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-24490)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | linux-oem-osp1 | 5.0.0-1070.76 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-raspi2-5.3 | 5.3.0-1036.38 |
Vulnerabilities 3
-
Unscored —CVE-2020-12351 Public exploit
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via …
-
Unscored —CVE-2020-12352 Public exploit
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adj…
-
Unscored —CVE-2020-24490 Public exploit
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adj…