Arch Linux Security Advisory ASA-202010-3 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux-zen Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1249 Summary ======= The package linux-zen before version 5.9.1.zen2-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.9.1.zen2-1. # pacman -Syu "linux-zen>=5.9.1.zen2-1" The problems have been fixed upstream in version 5.9.1.zen2. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00... https://github.com/google/security-research/security/advisories/GHSA-h637-c8... https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz@... https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@... https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq... https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2... https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git... https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490