Arch Linux alert ASA-202010-4 (linux-lts)
| From: | Morten Linderud <foxboron@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [ASA-202010-4] linux-lts: multiple issues | |
| Date: | Wed, 21 Oct 2020 09:05:31 +0200 | |
| Message-ID: | <20201021070531.dgx5g2m2vwmepbir@anathema> |
Arch Linux Security Advisory ASA-202010-4 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux-lts Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1250 Summary ======= The package linux-lts before version 5.4.72-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.4.72-1. # pacman -Syu "linux-lts>=5.4.72-1" The problems have been fixed upstream in version 5.4.72. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/a... https://github.com/google/security-research/security/advi... https://lore.kernel.org/linux-bluetooth/20200806181714.32... https://lore.kernel.org/linux-bluetooth/20200806181714.32... https://github.com/google/security-research/security/advi... https://github.com/google/security-research/security/advi... https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth... https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490