Bug 1489716 (CVE-2017-1000251)

Summary: CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agordeev, airlied, ajax, anemec, aquini, bhu, blc, bskeggs, cperry, dhoward, dvlasenk, emcnabb, eparis, esammons, esandeen, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, joe.lawrence, jonathan, josef, jpoimboe, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, lwang, matt, mchehab, mcressma, mguzik, mjc, mjg59, mlangsdo, mmilgram, nhorman, nmurray, plougher, pmatouse, ppandit, quintela, rt-maint, rvrbovsk, security-response-team, sheldon.corey, sheldon.corey, vdronov, williams, wmealing
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges.
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-09-14 16:15:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1489788, 1489789, 1489790, 1489791, 1489792, 1489793, 1489794, 1489930, 1489931, 1490060, 1490061, 1490062, 1490229, 1490230, 1490231, 1490232, 1490906, 1490908    
Bug Blocks: 1489723, 1489890    

Description Andrej Nemec 2017-09-08 08:13:03 UTC
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.

External References:

https://www.armis.com/blueborne/
https://access.redhat.com/security/vulnerabilities/blueborne
https://access.redhat.com/solutions/3177231
https://access.redhat.com/blogs/product-security/posts/blueborne

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3

Comment 17 Adam Mariš 2017-09-11 07:30:37 UTC
Acknowledgments:

Name: Armis Labs

Comment 24 Andrej Nemec 2017-09-12 13:03:10 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1490906]

Comment 28 errata-xmlrpc 2017-09-12 15:54:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.4 Advanced Update Support

Via RHSA-2017:2683 https://access.redhat.com/errata/RHSA-2017:2683

Comment 29 errata-xmlrpc 2017-09-12 17:10:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2679 https://access.redhat.com/errata/RHSA-2017:2679

Comment 30 errata-xmlrpc 2017-09-12 17:17:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Extended Update Support

Via RHSA-2017:2680 https://access.redhat.com/errata/RHSA-2017:2680

Comment 31 errata-xmlrpc 2017-09-12 17:20:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2017:2682 https://access.redhat.com/errata/RHSA-2017:2682

Comment 32 errata-xmlrpc 2017-09-12 17:46:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:2681 https://access.redhat.com/errata/RHSA-2017:2681

Comment 33 errata-xmlrpc 2017-09-13 13:43:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2704 https://access.redhat.com/errata/RHSA-2017:2704

Comment 34 errata-xmlrpc 2017-09-13 13:45:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2705 https://access.redhat.com/errata/RHSA-2017:2705

Comment 35 errata-xmlrpc 2017-09-13 14:17:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:2706 https://access.redhat.com/errata/RHSA-2017:2706

Comment 36 errata-xmlrpc 2017-09-13 14:30:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support

Via RHSA-2017:2707 https://access.redhat.com/errata/RHSA-2017:2707

Comment 37 errata-xmlrpc 2017-09-14 13:59:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.2 Advanced Update Support

Via RHSA-2017:2732 https://access.redhat.com/errata/RHSA-2017:2732

Comment 38 errata-xmlrpc 2017-09-14 14:10:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support

Via RHSA-2017:2731 https://access.redhat.com/errata/RHSA-2017:2731

Comment 39 Martin Prpič 2017-09-18 07:34:00 UTC
Statement:

This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of the kernel packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 will address this issue.

For further information please refer to the vulnerability article in the Customer Portal: https://access.redhat.com/security/vulnerabilities/blueborne