Summary
Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux
kernel contained a type-confusion error. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-12351)
Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux
kernel did not properly initialize memory in some situations. A physically
proximate remote attacker could use this to expose sensitive information
(kernel memory). (CVE-2020-12352)
Andy Nguyen discovered that the Bluetooth HCI event packet parser in the
Linux kernel did not properly handle event advertisements of certain sizes,
leading to a heap-based buffer overflow. A physically proximate remote
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2020-24490)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Media drivers;
- Network drivers;
- SMB network file system;
- Bluetooth subsystem;
- Amateur Radio drivers;
- Network traffic control;
- VMware vSockets driver;
(CVE-2024-35963, CVE-2024-38553, CVE-2024-35965, CVE-2024-26822,
CVE-2024-35966, CVE-2024-53057, CVE-2024-43904, CVE-2024-50264,
CVE-2024-40973, CVE-2024-40910, CVE-2024-35967)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-aws-5.15 | 5.15.0-1075.82~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp-5.15 | 5.15.0-1074.83~20.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-hwe-5.15 | 5.15.0-130.140~20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws | 5.15.0-1076.83 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gcp | 5.15.0-1074.83 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia | 5.15.0-1070.71 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-oracle | 5.15.0-1073.79 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-raspi | 5.15.0-1070.73 |
Vulnerabilities 14
-
High 8.8
ax25: Fix refcount imbalance on inbound connections
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execu…
-
High 8.7
smb: client: set correct id, uid and cruid for multiuser automounts
In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automountin…
-
High 7.8
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After…
-
High 7.8
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it…
-
High 7.1
Bluetooth: hci_sock: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length before copying data.
-
High 7.1
Bluetooth: SCO: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_…
-
Unscored —CVE-2020-12351 Public exploit
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via …
-
Unscored —CVE-2020-12352 Public exploit
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adj…
-
Unscored —CVE-2020-24490 Public exploit
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adj…
-
Unscored —
Bluetooth: L2CAP: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user input length before copying data.
-
Unscored —
Bluetooth: RFCOMM: Fix not validating setsockopt user input
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in …
-
Unscored —
net: fec: remove .ndo_poll_controller to avoid deadlocks
In the Linux kernel, the following vulnerability has been resolved: net: fec: remove .ndo_poll_controller to avoid deadlocks There is a deadlock issue found in sungem driver, please refer to the commit ac0a230f719b ("eth: sungem: remove .ndo_poll_controller t…
-
Unscored —
media: mtk-vcodec: potential null pointer deference in SCP
In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113.
-
Unscored —
drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing This commit adds null checks for the 'stream' and 'plane' variables in the dcn30_apply_idle_power_optimizations …
References
-
report
https://ubuntu.com/security/CVE-2020-12351
-
report
https://ubuntu.com/security/CVE-2020-12352
-
report
https://ubuntu.com/security/CVE-2020-24490
-
report
https://ubuntu.com/security/CVE-2024-26822
-
report
https://ubuntu.com/security/CVE-2024-35963
-
report
https://ubuntu.com/security/CVE-2024-35965
-
report
https://ubuntu.com/security/CVE-2024-35966
-
report
https://ubuntu.com/security/CVE-2024-35967
-
report
https://ubuntu.com/security/CVE-2024-38553
-
report
https://ubuntu.com/security/CVE-2024-40910
-
report
https://ubuntu.com/security/CVE-2024-40973
-
report
https://ubuntu.com/security/CVE-2024-43904
-
report
https://ubuntu.com/security/CVE-2024-50264
-
report
https://ubuntu.com/security/CVE-2024-53057