CVE-2017-13220: High severity Google Android vulnerability
An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053.
Other sources
An out-of-bound access and a possible memory corruption vulnerability leading to a system crash was found in the Linux kernel in the BlueTooth subsystem. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Previously this vulnerability was referenced as a flaw in Android kernel with an id of A-63527053.
References:
https://source.android.com/security/bulletin/pixel/2018-01-01#kernel-components
http://seclists.org/oss-sec/2018/q2/28
An upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51bda2bca53b265715ca1852528f38dc67429d9a
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch A-63527053
Event History
Frequently Asked Questions
What is CVE-2017-13220?
CVE-2017-13220 is an elevation of privilege vulnerability in the Upstream kernel bluez.
What product is affected by CVE-2017-13220?
Android is the product affected by CVE-2017-13220.
What is the severity of CVE-2017-13220?
CVE-2017-13220 has a severity level of medium.
How do I fix CVE-2017-13220 in Android kernel version 3.13.0-149.199?
To fix CVE-2017-13220 in Android kernel version 3.13.0-149.199, apply the necessary security patches provided by the Ubuntu source.
Where can I find more information about CVE-2017-13220?
You can find more information about CVE-2017-13220 in the following references: [Link 1](https://source.android.com/security/bulletin/pixel/2018-01-01), [Link 2](https://bugzilla.redhat.com/show_bug.cgi?id=1536155), [Link 3](https://bugzilla.suse.com/show_bug.cgi?id=1076537).