[ASA-202010-3] linux-zen: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-202010-3
=========================================

Severity: High
Date    : 2020-10-18
CVE-ID  : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490
Package : linux-zen
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1249

Summary
=======

The package linux-zen before version 5.9.1.zen2-1 is vulnerable to
multiple issues including information disclosure, privilege escalation
and denial of service.

Resolution
==========

Upgrade to 5.9.1.zen2-1.

# pacman -Syu "linux-zen>=5.9.1.zen2-1"

The problems have been fixed upstream in version 5.9.1.zen2.

Workaround
==========

None.

Description
===========

- CVE-2020-12351 (privilege escalation)

A flaw was found in the way the Linux kernel Bluetooth implementation
handled L2CAP packets with A2MP CID. A remote attacker in adjacent
range could use this flaw to crash the system causing denial of service
or potentially execute arbitrary code on the system by sending a
specially crafted L2CAP packet. The highest threat from this
vulnerability is to data confidentiality and integrity as well as
system availability.

- CVE-2020-12352 (information disclosure)

An information leak flaw was found in the way the Linux kernel's
Bluetooth stack implementation handled initialization of stack memory
when handling certain AMP packets. A remote attacker in adjacent range
could use this flaw to leak small portions of stack memory on the
system by sending a specially crafted AMP packets. The highest threat
from this vulnerability is to data confidentiality.

- CVE-2020-24490 (denial of service)

A heap buffer overflow flaw was found in the way the Linux kernel’s
Bluetooth implementation processed extended advertising report events.
This flaw allows a remote attacker in an adjacent range to crash the
system, causing a denial of service or to potentially execute arbitrary
code on the system by sending a specially crafted Bluetooth packet. The
highest threat from this vulnerability is to confidentiality,
integrity, as well as system availability.

Impact
======

A remote unauthenticated attacker in range is able to execute arbitrary
code, disclose information or DoS the system through bluetooth.

References
==========

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq
https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz@gmail.com/
https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/
https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq
https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=a2ec905d1e160a33b2e210e45ad30445ef26ce0e
https://security.archlinux.org/CVE-2020-12351
https://security.archlinux.org/CVE-2020-12352
https://security.archlinux.org/CVE-2020-24490
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20201021/a891d975/attachment.sig>