CVE-2020-24490: Input Validation
First published: Tue Feb 02 2021(Updated: )
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.
Credit: secure@intel.com secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BlueZ BlueZ | ||
| Linux Linux kernel | >=4.19<4.19.137 | |
| Linux Linux kernel | >=4.20<5.4.56 | |
| Linux Linux kernel | >=5.5.0<5.7.13 | |
| Linux Linux kernel | =5.8 | |
| Linux Linux kernel | =5.9 | |
| All of | ||
| BlueZ BlueZ | ||
| Any of | ||
| Linux Linux kernel | >=4.19<4.19.137 | |
| Linux Linux kernel | >=4.20<5.4.56 | |
| Linux Linux kernel | >=5.5.0<5.7.13 | |
| debian/linux | 5.10.223-1 6.1.106-3 6.1.99-1 6.10.9-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
- https://launchpad.net/bugs/cve/CVE-2020-24490
- https://www.zdnet.com/article/google-warns-of-severe-bleedingtooth-bluetooth-flaw-in-linux-kernel/
- https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649
- https://git.kernel.org/linus/a2ec905d1e160a33b2e210e45ad30445ef26ce0e
- https://security-tracker.debian.org/tracker/CVE-2020-24490
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24490
- https://nvd.nist.gov/vuln/detail/CVE-2020-24490
- https://ubuntu.com/security/CVE-2020-24490
Frequently Asked Questions
What is CVE-2020-24490?
CVE-2020-24490 is a vulnerability that involves improper buffer restrictions in BlueZ, which may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Which versions of Linux kernel are affected by CVE-2020-24490?
All Linux kernel versions that support BlueZ are affected by CVE-2020-24490.
How can an unauthenticated user exploit CVE-2020-24490?
An unauthenticated user can potentially enable denial of service by leveraging the improper buffer restrictions in BlueZ.
Are there any remedies available for CVE-2020-24490?
Yes, remedies are available. For Ubuntu users, updating to Linux kernel version 5.8 or later can mitigate this vulnerability.
Where can I find more information about CVE-2020-24490?
You can find more information about CVE-2020-24490 on the Intel Security Center, Launchpad, and MITRE CVE websites.
- collector/nvd-index
- zeroday/true
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/severity
- agent/weakness
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/zdnet-article
- source/ZDNet
- alias/CVE-2020-12351
- alias/CVE-2020-12352
- alias/CVE-2020-24490
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- vendor/bluez
- canonical/bluez bluez
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.19
- version/linux linux kernel/4.20
- version/linux linux kernel/5.5.0
- version/linux linux kernel/5.8
- version/linux linux kernel/5.9
- package-manager/debian