Bug 1489716 - (CVE-2017-1000251) CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack
CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170912,repo...
: Security
Depends On: 1490062 1489788 1489789 1489790 1489791 1489792 1489793 1489794 1489930 1489931 1490060 1490061 1490229 1490230 1490231 1490232 1490906 1490908
Blocks: 1489723 1489890
  Show dependency treegraph
 
Reported: 2017-09-08 04:13 EDT by Andrej Nemec
Modified: 2017-10-09 10:05 EDT (History)
60 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-09-14 12:15:57 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Andrej Nemec 2017-09-08 04:13:03 EDT
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.

External References:

https://www.armis.com/blueborne/
https://access.redhat.com/security/vulnerabilities/blueborne
https://access.redhat.com/solutions/3177231
https://access.redhat.com/blogs/product-security/posts/blueborne

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3
Comment 17 Adam Mariš 2017-09-11 03:30:37 EDT
Acknowledgments:

Name: Armis Labs
Comment 24 Andrej Nemec 2017-09-12 09:03:10 EDT
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1490906]
Comment 28 errata-xmlrpc 2017-09-12 11:54:01 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.4 Advanced Update Support

Via RHSA-2017:2683 https://access.redhat.com/errata/RHSA-2017:2683
Comment 29 errata-xmlrpc 2017-09-12 13:10:27 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2679 https://access.redhat.com/errata/RHSA-2017:2679
Comment 30 errata-xmlrpc 2017-09-12 13:17:04 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Extended Update Support

Via RHSA-2017:2680 https://access.redhat.com/errata/RHSA-2017:2680
Comment 31 errata-xmlrpc 2017-09-12 13:20:10 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2017:2682 https://access.redhat.com/errata/RHSA-2017:2682
Comment 32 errata-xmlrpc 2017-09-12 13:46:57 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:2681 https://access.redhat.com/errata/RHSA-2017:2681
Comment 33 errata-xmlrpc 2017-09-13 09:43:29 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2704 https://access.redhat.com/errata/RHSA-2017:2704
Comment 34 errata-xmlrpc 2017-09-13 09:45:27 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2705 https://access.redhat.com/errata/RHSA-2017:2705
Comment 35 errata-xmlrpc 2017-09-13 10:17:58 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:2706 https://access.redhat.com/errata/RHSA-2017:2706
Comment 36 errata-xmlrpc 2017-09-13 10:30:05 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support

Via RHSA-2017:2707 https://access.redhat.com/errata/RHSA-2017:2707
Comment 37 errata-xmlrpc 2017-09-14 09:59:21 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.2 Advanced Update Support

Via RHSA-2017:2732 https://access.redhat.com/errata/RHSA-2017:2732
Comment 38 errata-xmlrpc 2017-09-14 10:10:49 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support

Via RHSA-2017:2731 https://access.redhat.com/errata/RHSA-2017:2731
Comment 39 Martin Prpič 2017-09-18 03:34:00 EDT
Statement:

This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of the kernel packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 will address this issue.

For further information please refer to the vulnerability article in the Customer Portal: https://access.redhat.com/security/vulnerabilities/blueborne

Note You need to log in before you can comment on or make changes to this bug.