[ASA-202010-4] linux-lts: multiple issues
foxboron at archlinux.org
Wed Oct 21 07:05:31 UTC 2020
Arch Linux Security Advisory ASA-202010-4
Date : 2020-10-18
CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490
Package : linux-lts
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1250
The package linux-lts before version 5.4.72-1 is vulnerable to multiple
issues including information disclosure, privilege escalation and
denial of service.
Upgrade to 5.4.72-1.
# pacman -Syu "linux-lts>=5.4.72-1"
The problems have been fixed upstream in version 5.4.72.
- CVE-2020-12351 (privilege escalation)
A flaw was found in the way the Linux kernel Bluetooth implementation
handled L2CAP packets with A2MP CID. A remote attacker in adjacent
range could use this flaw to crash the system causing denial of service
or potentially execute arbitrary code on the system by sending a
specially crafted L2CAP packet. The highest threat from this
vulnerability is to data confidentiality and integrity as well as
- CVE-2020-12352 (information disclosure)
An information leak flaw was found in the way the Linux kernel's
Bluetooth stack implementation handled initialization of stack memory
when handling certain AMP packets. A remote attacker in adjacent range
could use this flaw to leak small portions of stack memory on the
system by sending a specially crafted AMP packets. The highest threat
from this vulnerability is to data confidentiality.
- CVE-2020-24490 (denial of service)
A heap buffer overflow flaw was found in the way the Linux kernel’s
Bluetooth implementation processed extended advertising report events.
This flaw allows a remote attacker in an adjacent range to crash the
system, causing a denial of service or to potentially execute arbitrary
code on the system by sending a specially crafted Bluetooth packet. The
highest threat from this vulnerability is to confidentiality,
integrity, as well as system availability.
A remote unauthenticated attacker in range is able to execute arbitrary
code, disclose information or DoS the system through bluetooth.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security