Bug 1489716 (CVE-2017-1000251)
| Summary: | CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | agordeev, airlied, ajax, anemec, aquini, bhu, blc, bskeggs, cperry, dhoward, dvlasenk, emcnabb, eparis, esammons, esandeen, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, joe.lawrence, jonathan, josef, jpoimboe, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, lwang, matt, mchehab, mcressma, mguzik, mjc, mjg59, mlangsdo, mmilgram, nhorman, nmurray, plougher, pmatouse, ppandit, quintela, rt-maint, rvrbovsk, security-response-team, sheldon.corey, sheldon.corey, vdronov, williams, wmealing |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-09-14 16:15:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1489788, 1489789, 1489790, 1489791, 1489792, 1489793, 1489794, 1489930, 1489931, 1490060, 1490061, 1490062, 1490229, 1490230, 1490231, 1490232, 1490906, 1490908 | ||
| Bug Blocks: | 1489723, 1489890 | ||
|
Description
Andrej Nemec
2017-09-08 08:13:03 UTC
Acknowledgments: Name: Armis Labs Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1490906] This issue has been addressed in the following products: Red Hat Enterprise Linux 6.4 Advanced Update Support Via RHSA-2017:2683 https://access.redhat.com/errata/RHSA-2017:2683 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:2679 https://access.redhat.com/errata/RHSA-2017:2679 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2017:2680 https://access.redhat.com/errata/RHSA-2017:2680 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2017:2682 https://access.redhat.com/errata/RHSA-2017:2682 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2017:2681 https://access.redhat.com/errata/RHSA-2017:2681 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:2704 https://access.redhat.com/errata/RHSA-2017:2704 This issue has been addressed in the following products: Red Hat Enterprise MRG 2 Via RHSA-2017:2705 https://access.redhat.com/errata/RHSA-2017:2705 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Extended Update Support Via RHSA-2017:2706 https://access.redhat.com/errata/RHSA-2017:2706 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.5 Advanced Update Support Red Hat Enterprise Linux 6.5 Telco Extended Update Support Via RHSA-2017:2707 https://access.redhat.com/errata/RHSA-2017:2707 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.2 Advanced Update Support Via RHSA-2017:2732 https://access.redhat.com/errata/RHSA-2017:2732 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 Advanced Update Support Red Hat Enterprise Linux 6.6 Telco Extended Update Support Via RHSA-2017:2731 https://access.redhat.com/errata/RHSA-2017:2731 Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5. This issue affects the version of the kernel packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 will address this issue. For further information please refer to the vulnerability article in the Customer Portal: https://access.redhat.com/security/vulnerabilities/blueborne |