Bug 1489716 (CVE-2017-1000251) - CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack
Summary: CVE-2017-1000251 kernel: stack buffer overflow in the native Bluetooth stack
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-1000251
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1489788 1489789 1489790 1489791 1489792 1489793 1489794 1489930 1489931 1490060 1490061 1490062 1490229 1490230 1490231 1490232 1490906 1490908
Blocks: 1489723 1489890
TreeView+ depends on / blocked
 
Reported: 2017-09-08 08:13 UTC by Andrej Nemec
Modified: 2021-02-17 01:35 UTC (History)
60 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges.
Clone Of:
Environment:
Last Closed: 2017-09-14 16:15:57 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2679 0 normal SHIPPED_LIVE Important: kernel security update 2017-09-12 21:08:49 UTC
Red Hat Product Errata RHSA-2017:2680 0 normal SHIPPED_LIVE Important: kernel security update 2017-09-12 21:15:46 UTC
Red Hat Product Errata RHSA-2017:2681 0 normal SHIPPED_LIVE Important: kernel security update 2017-09-12 21:46:15 UTC
Red Hat Product Errata RHSA-2017:2682 0 normal SHIPPED_LIVE Important: kernel security update 2017-09-12 21:19:11 UTC
Red Hat Product Errata RHSA-2017:2683 0 normal SHIPPED_LIVE Important: kernel security update 2017-09-12 19:53:15 UTC
Red Hat Product Errata RHSA-2017:2704 0 normal SHIPPED_LIVE Important: kernel-rt security update 2017-09-13 17:42:44 UTC
Red Hat Product Errata RHSA-2017:2705 0 normal SHIPPED_LIVE Important: kernel-rt security update 2017-09-13 17:44:44 UTC
Red Hat Product Errata RHSA-2017:2706 0 normal SHIPPED_LIVE Important: kernel security update 2017-09-13 18:17:09 UTC
Red Hat Product Errata RHSA-2017:2707 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-09-13 18:29:09 UTC
Red Hat Product Errata RHSA-2017:2731 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-09-14 18:09:48 UTC
Red Hat Product Errata RHSA-2017:2732 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-09-14 17:57:58 UTC

Description Andrej Nemec 2017-09-08 08:13:03 UTC
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.

External References:

https://www.armis.com/blueborne/
https://access.redhat.com/security/vulnerabilities/blueborne
https://access.redhat.com/solutions/3177231
https://access.redhat.com/blogs/product-security/posts/blueborne

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3

Comment 17 Adam Mariš 2017-09-11 07:30:37 UTC
Acknowledgments:

Name: Armis Labs

Comment 24 Andrej Nemec 2017-09-12 13:03:10 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1490906]

Comment 28 errata-xmlrpc 2017-09-12 15:54:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.4 Advanced Update Support

Via RHSA-2017:2683 https://access.redhat.com/errata/RHSA-2017:2683

Comment 29 errata-xmlrpc 2017-09-12 17:10:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2679 https://access.redhat.com/errata/RHSA-2017:2679

Comment 30 errata-xmlrpc 2017-09-12 17:17:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Extended Update Support

Via RHSA-2017:2680 https://access.redhat.com/errata/RHSA-2017:2680

Comment 31 errata-xmlrpc 2017-09-12 17:20:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2017:2682 https://access.redhat.com/errata/RHSA-2017:2682

Comment 32 errata-xmlrpc 2017-09-12 17:46:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:2681 https://access.redhat.com/errata/RHSA-2017:2681

Comment 33 errata-xmlrpc 2017-09-13 13:43:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2704 https://access.redhat.com/errata/RHSA-2017:2704

Comment 34 errata-xmlrpc 2017-09-13 13:45:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2705 https://access.redhat.com/errata/RHSA-2017:2705

Comment 35 errata-xmlrpc 2017-09-13 14:17:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:2706 https://access.redhat.com/errata/RHSA-2017:2706

Comment 36 errata-xmlrpc 2017-09-13 14:30:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support

Via RHSA-2017:2707 https://access.redhat.com/errata/RHSA-2017:2707

Comment 37 errata-xmlrpc 2017-09-14 13:59:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.2 Advanced Update Support

Via RHSA-2017:2732 https://access.redhat.com/errata/RHSA-2017:2732

Comment 38 errata-xmlrpc 2017-09-14 14:10:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support

Via RHSA-2017:2731 https://access.redhat.com/errata/RHSA-2017:2731

Comment 39 Martin Prpič 2017-09-18 07:34:00 UTC
Statement:

This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of the kernel packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 will address this issue.

For further information please refer to the vulnerability article in the Customer Portal: https://access.redhat.com/security/vulnerabilities/blueborne


Note You need to log in before you can comment on or make changes to this bug.