Bug 914298 (CVE-2013-0349)
| Summary: | CVE-2013-0349 kernel: bluetooth HIDP implementation information disclosure | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Prasad Pandit <ppandit> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | agordeev, anton, bhu, davej, dhoward, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, jneedle, jonathan, jshao, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, madhu.chinakonda, mcressma, npajkovs, plougher, rt-maint, rvrbovsk, sforsber, tpelka, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-04-23 20:51:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 914690, 914691, 914693 | ||
| Bug Blocks: | 905769 | ||
Statement: This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6. This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2. This was fixed in the upstream 3.7.6 stable kernel with commit e18ef0a55a00817e7ce7be8b3e0e725a2caaf1f2. All supported Fedora versions are on 3.7.8 or newer, so the issue is already resolved in Fedora. Created kernel tracking bugs for this issue Affects: fedora-all [bug 914693] This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:0744 https://rhn.redhat.com/errata/RHSA-2013-0744.html |
Linux kernel built with Bluetooth stack and HIDP support HCONFIG_BT=y/m & CONFIG_BT_HIDP=y/m is vulnerable to an information disclosure flaw caused by wrongly initialising the hid_device->name, physical location and unique identifier variables. Information leakage happens if these variables are not NULL('\0') terminated. A privileged(CAP_NET_ADMIN) user/program could cause this via ioctl(HIDPCONNADD) call. Upstream fix: -> https://git.kernel.org/linus/0a9ab9bdb3e891762553f667066190c1d22ad62b