CVE-2019-3460: Infoleak
A flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2capparseconfrsp and l2capparseconfreq functions. An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.
Other sources
A flaw was found in the Linux kernels implementation of Logical link control and adaptation protocol (L2CAP), part of the bluetooth stack in the l2capparseconfrsp, l2capparseconfreq functions.
An attacker with physical access within the range of standard bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.
Upstream patch: https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/
Oss-security post: https://seclists.org/oss-sec/2019/q1/58
Mitigation:
- Disabling the bluetooth hardware in the bios. - Prevent loading of the bluetooth kernel modules. - Disable the bluetooth connection by putting the system in "airport" mode.
— Red Hat
A heap data infoleak in multiple locations including L2CAPPARSECONFRSP was found in the Linux kernel before 5.1-rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.rt56.1022.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1062.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.18.1.el7a - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-3460?
The severity of CVE-2019-3460 is classified as high due to the potential for an attacker to exploit Bluetooth functionalities.
How do I fix CVE-2019-3460?
To fix CVE-2019-3460, update your Linux kernel to versions 0:3.10.0-1062.rt56.1022.el7, 0:3.10.0-1062.el7, or other specified remedial versions.
Which systems are affected by CVE-2019-3460?
CVE-2019-3460 affects various Linux distributions including Red Hat, Ubuntu, and Debian, specifically certain kernel versions.
Can I be attacked through CVE-2019-3460 if my Bluetooth is turned off?
If Bluetooth is turned off, the vulnerability exploited by CVE-2019-3460 cannot be triggered, but keeping software updated is still recommended.
What types of attacks are possible with CVE-2019-3460?
CVE-2019-3460 can allow an attacker within Bluetooth range to conduct man-in-the-middle attacks or potentially execute arbitrary code.