[arch-security] [ASA-201709-12] linux-zen: arbitrary code execution
anthraxx at archlinux.org
Mon Sep 18 14:37:11 UTC 2017
Arch Linux Security Advisory ASA-201709-12
Date : 2017-09-18
CVE-ID : CVE-2017-1000251
Package : linux-zen
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-394
The package linux-zen before version 4.13.2-1 is vulnerable to
arbitrary code execution.
Upgrade to 4.13.2-1.
# pacman -Syu "linux-zen>=4.13.2-1"
The problem has been fixed upstream in version 4.13.2.
A stack buffer overflow flaw was found in the way the Bluetooth
subsystem of the Linux kernel processed pending L2CAP configuration
responses from a client. On systems with the stack protection feature
enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on
all architectures), an unauthenticated attacker able to initiate a
connection to a system via Bluetooth could use this flaw to crash the
system. Due to the nature of the stack protection feature, code
execution cannot be fully ruled out, although it is unlikely. On
systems without the stack protection feature, an unauthenticated
attacker able to initiate a connection to a system via Bluetooth could
use this flaw to remotely execute arbitrary code on the system with
ring 0 (kernel) privileges.
An unauthenticated attacker able to initiate a connection via Bluetooth
is able to crash the system or possibly execute arbitrary code.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 866 bytes
Desc: OpenPGP digital signature
More information about the arch-security