CVE-2020-12352: Input Validation
First published: Thu Oct 08 2020(Updated: )
An information leak flaw was found in the way Linux kernel Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets.
Credit: secure@intel.com secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1160.2.2.rt56.1134.el7 | 0:3.10.0-1160.2.2.rt56.1134.el7 |
| redhat/kernel | <0:3.10.0-1160.2.2.el7 | 0:3.10.0-1160.2.2.el7 |
| redhat/kernel-alt | <0:4.14.0-115.32.1.el7a | 0:4.14.0-115.32.1.el7a |
| redhat/kernel | <0:3.10.0-327.93.1.el7 | 0:3.10.0-327.93.1.el7 |
| redhat/kernel | <0:3.10.0-514.85.1.el7 | 0:3.10.0-514.85.1.el7 |
| redhat/kernel | <0:3.10.0-693.77.1.el7 | 0:3.10.0-693.77.1.el7 |
| redhat/kernel | <0:3.10.0-957.61.2.el7 | 0:3.10.0-957.61.2.el7 |
| redhat/kernel | <0:3.10.0-1062.37.1.el7 | 0:3.10.0-1062.37.1.el7 |
| redhat/kernel-rt | <0:4.18.0-193.28.1.rt13.77.el8_2 | 0:4.18.0-193.28.1.rt13.77.el8_2 |
| redhat/kernel | <0:4.18.0-193.28.1.el8_2 | 0:4.18.0-193.28.1.el8_2 |
| redhat/kernel | <0:4.18.0-80.30.1.el8_0 | 0:4.18.0-80.30.1.el8_0 |
| redhat/kernel | <0:4.18.0-147.32.1.el8_1 | 0:4.18.0-147.32.1.el8_1 |
| Linux Linux kernel | =5.8 | |
| Linux Linux kernel | =5.9 | |
| Linux Linux kernel | >=5.4<5.4.72 | |
| Linux Linux kernel | >=5.8.0<5.8.16 | |
| Linux Linux kernel | >=5.9.0<=5.9.13 | |
| BlueZ BlueZ | ||
| All of | ||
| Any of | ||
| Linux Linux kernel | >=5.4<5.4.72 | |
| Linux Linux kernel | >=5.8.0<5.8.16 | |
| Linux Linux kernel | >=5.9.0<=5.9.13 | |
| BlueZ BlueZ | ||
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.12.6-1 |
Remedy
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931. Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-12352 https://nvd.nist.gov/vuln/detail/CVE-2020-12352 https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/ https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1886529
- https://access.redhat.com/errata/RHSA-2020:4280
- https://access.redhat.com/errata/RHSA-2020:4276
- https://access.redhat.com/errata/RHSA-2020:4279
- https://access.redhat.com/errata/RHSA-2020:4990
- https://access.redhat.com/errata/RHSA-2020:4991
- https://access.redhat.com/errata/RHSA-2020:4278
- https://access.redhat.com/errata/RHSA-2020:4281
- https://access.redhat.com/errata/RHSA-2020:4277
- https://access.redhat.com/errata/RHSA-2020:4289
- https://access.redhat.com/errata/RHSA-2020:4286
- https://access.redhat.com/errata/RHSA-2020:4288
- https://access.redhat.com/errata/RHSA-2020:4287
- https://access.redhat.com/security/cve/cve-2020-12352
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html?wapkw=CVE-2020-12351
- http://packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.html
- http://packetstormsecurity.com/files/162131/Linux-Kernel-5.4-BleedingTooth-Remote-Code-Execution.html
- https://launchpad.net/bugs/cve/CVE-2020-12352
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1888440
- https://access.redhat.com/security/vulnerabilities/BleedingTooth
- https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
- https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq
- https://access.redhat.com/solutions/2682931
- https://www.zdnet.com/article/google-warns-of-severe-bleedingtooth-bluetooth-flaw-in-linux-kernel/
- https://git.kernel.org/linus/eddb7732119d53400f48a02536a84c509692faa8
- https://security-tracker.debian.org/tracker/CVE-2020-12352
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12352
- https://nvd.nist.gov/vuln/detail/CVE-2020-12352
- https://ubuntu.com/security/CVE-2020-12352
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- zeroday/true
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-12352
- collector/nvd-index
- agent/software-canonical-lookup
- agent/author
- agent/weakness
- agent/severity
- collector/zdnet-article
- source/ZDNet
- alias/CVE-2020-12351
- alias/CVE-2020-24490
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/5.8
- version/linux linux kernel/5.9
- vendor/bluez
- version/linux linux kernel/5.4
- version/linux linux kernel/5.8.0
- version/linux linux kernel/5.9.0
- version/linux linux kernel/5.9.13
- canonical/bluez bluez
- package-manager/debian