ArchLinux: 202010-2: linux: multiple issues
Summary
- CVE-2020-12351 (privilege escalation)
A flaw was found in the way the Linux kernel Bluetooth implementation
handled L2CAP packets with A2MP CID. A remote attacker in adjacent
range could use this flaw to crash the system causing denial of service
or potentially execute arbitrary code on the system by sending a
specially crafted L2CAP packet. The highest threat from this
vulnerability is to data confidentiality and integrity as well as
system availability.
- CVE-2020-12352 (information disclosure)
An information leak flaw was found in the way the Linux kernel's
Bluetooth stack implementation handled initialization of stack memory
when handling certain AMP packets. A remote attacker in adjacent range
could use this flaw to leak small portions of stack memory on the
system by sending a specially crafted AMP packets. The highest threat
from this vulnerability is to data confidentiality.
- CVE-2020-24490 (denial of service)
A heap buffer overflow flaw was found in the way the Linux kernel’s
Bluetooth implementation processed extended advertising report events.
This flaw allows a remote attacker in an adjacent range to crash the
system, causing a denial of service or to potentially execute arbitrary
code on the system by sending a specially crafted Bluetooth packet. The
highest threat from this vulnerability is to confidentiality,
integrity, as well as system availability.
Resolution
Upgrade to 5.9.1.arch1-1.
# pacman -Syu "linux>=5.9.1.arch1-1"
The problems have been fixed upstream in version 5.9.1.arch1.
References
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz@gmail.com/ https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/ https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649 https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=a2ec905d1e160a33b2e210e45ad30445ef26ce0e https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.