PT-2013-1017 · Linux+3 · Linux Kernel+3

Mathias Krause + 1 · Publicado 2013-03-07 · Atualizado 2019-04-22 · CVE-2012-6544

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.6

Description The Bluetooth protocol stack in the Linux kernel does not properly initialize certain structures, allowing local users to obtain sensitive information from kernel stack memory via a crafted application that targets the L2CAP or HCI implementation.

Recommendations For Linux kernel versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the L2CAP and HCI implementations until a patch is available.

Correção

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-20

CWE-200

Identificadores relacionados

BDU:2014-00077

CESA-2013_1173

CVE-2012-6544

DSA-2668-1

RHSA-2013:1034

RHSA-2013:1173

RHSA-2013:1195

RHSA-2013_1034

RHSA-2013_1173

SUSE-SU-2015:0652-1

USN-1599-1

USN-1610-1

USN-1648-1

USN-1649-1

USN-1652-1

USN-1805-1

USN-1808-1

Produtos afetados

Centos

Linux Kernel

Red Hat

Suse

Referências · 32

• https://github.com/torvalds/linux/commit/792039c73cf176c8e39a6e8beef2c94ff46522ed · Nota
• https://github.com/torvalds/linux/commit/e15ca9a0ef9a86f0477530b0f44a725d67f889ee · Nota
• https://github.com/torvalds/linux/commit/3f68ba07b1da811bf383b4b701b129bfcb2e4988 · Nota
• https://bdu.fstec.ru/vul/2014-00077 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2013-1173.html · Aviso do Fabricante
• https://kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2 · Correção
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=792039c73cf176c8e39a6e8beef2c94ff46522ed · Nota
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e15ca9a0ef9a86f0477530b0f44a725d67f889ee · Nota
• http://ubuntu.com/usn/USN-1805-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2013-1173.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/03/05/13 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6544 · Nota de Segurança
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3f68ba07b1da811bf383b4b701b129bfcb2e4988 · Nota
• https://ubuntu.com/security/notices/USN-1652-1 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2013-2542.html · Aviso do Fabricante