PT-2020-4306 · Linux+5 · Linux Kernel+6
Published
2020-07-30
·
Updated
2025-01-27
·
CVE-2020-24490
CVSS v3.1
6.5
Medium
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
BlueZ (affected versions not specified)
Linux kernel versions that support BlueZ
Description:
The issue is related to improper buffer restrictions in BlueZ, which may allow an unauthenticated user to potentially enable denial of service via adjacent access. It is also associated with a buffer overflow in dynamic memory, which could allow a remote attacker to execute arbitrary code or cause a denial of service using specially crafted L2CAP packets.
Recommendations:
For Linux kernel versions that support BlueZ, consider disabling BlueZ functionality until a patch is available.
As a temporary workaround, restrict access to the
hci event.c component to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Heap Based Buffer Overflow
Improper Access Control
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Bluez
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu