A flaw was found in the Linux kernels implementation of Logical link control and adaptation protocol (L2CAP), part of the bluetooth stack. An attacker with physical access within the range of standard bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack. Upstream patch: https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/ Oss-security post: https://seclists.org/oss-sec/2019/q1/58 Mitigation: - Disabling the bluetooth hardware in the bios. - Prevent loading of the bluetooth kernel modules. - Disable the bluetooth connection by putting the system in "airport" mode.
Public via: https://seclists.org/oss-sec/2019/q1/58
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1665925]
Hi Wade/Andrej, Seems patch for this https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/ Not yet made it to upstream ? Can you confirm ? Gopal..
(In reply to gopal krishna tiwari from comment #8) > Hi Wade/Andrej, > > Seems patch for this > > https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/ > > Not yet made it to upstream ? Can you confirm ? > > Gopal.. Hi Gopal, This seems to be the relevant upstream patch link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c9cbd0b5e38a1672fcd137894ace3b042dfbf69
(In reply to Andrej Nemec from comment #9) > (In reply to gopal krishna tiwari from comment #8) > > Hi Wade/Andrej, > > > > Seems patch for this > > > > https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/ > > > > Not yet made it to upstream ? Can you confirm ? > > > > Gopal.. > > Hi Gopal, > > This seems to be the relevant upstream patch link: > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > ?id=7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 Sure, Thanks. Will post this patch soon. Gopal
(In reply to Andrej Nemec from comment #9) > (In reply to gopal krishna tiwari from comment #8) > > Hi Wade/Andrej, > > > > Seems patch for this > > > > https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/ > > > > Not yet made it to upstream ? Can you confirm ? > > > > Gopal.. > > Hi Gopal, > > This seems to be the relevant upstream patch link: > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > ?id=7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 AFIU this patch fixes both CVE-2019-3459 & CVE-2019-3460 ? Gopal
(In reply to gopal krishna tiwari from comment #11) > (In reply to Andrej Nemec from comment #9) > > (In reply to gopal krishna tiwari from comment #8) > > > Hi Wade/Andrej, > > > > > > Seems patch for this > > > > > > https://lore.kernel.org/linux-bluetooth/20190110062833.GA15047@kroah.com/ > > > > > > Not yet made it to upstream ? Can you confirm ? > > > > > > Gopal.. > > > > Hi Gopal, > > > > This seems to be the relevant upstream patch link: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > > ?id=7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 > > AFIU this patch fixes both CVE-2019-3459 & CVE-2019-3460 ? > > Gopal Hello Gopal, Yes, this patch addresses both vulnerable functions L2CAP_GET_CONF_OPT (CVE-2019-3459) and L2CAP_PARSE_CONF_RSP (CVE-2019-3460).
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2029
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2019:2043
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3459
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3309
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3517 https://access.redhat.com/errata/RHSA-2019:3517
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0740 https://access.redhat.com/errata/RHSA-2020:0740