Vulnerability CVE-2017-1000251


Published: 2017-09-12   Modified: 2017-12-08

Description:
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Linux Kernel <= 4.13.1 BlueTooth Buffer Overflow (PoC)
Marcin Kozlowski
22.09.2017

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

Vendor: Linux
Product: Linux kernel 
Version:
4.9.9
4.9.8
4.9.7
4.9.6
4.9.5
4.9.44
4.9.43
4.9.42
4.9.41
4.9.40
4.9.4
4.9.39
4.9.38
4.9.37
4.9.36
4.9.35
4.9.34
4.9.33
4.9.32
4.9.31
4.9.30
4.9.3
4.9.29
4.9.28
4.9.27
4.9.26
4.9.25
4.9.24
4.9.23
4.9.22
4.9.21
4.9.20
4.9.2
4.9.19
4.9.18
4.9.17
4.9.16
4.9.15
4.9.14
4.9.13
4.9.12
4.9.11
4.9.10
4.9.1
4.9
4.8.9
4.8.8
4.8.7
4.8.6
4.8.5
4.8.4
4.8.3
4.8.2
4.8.17
4.8.16
4.8.15
4.8.14
4.8.13
4.8.12
4.8.11
4.8.10
4.8.1
4.8
4.7.9
4.7.6
4.7.4
4.7.3
4.7
4.6.7
4.6.6
4.6.5
4.6.4
4.6.3
4.6.2
4.6.1
4.6
4.5.7
4.5.5
4.5.4
4.5.3
4.5.2
4.5.1
4.5.0
4.4.9
4.4.83
4.4.82
4.4.81
4.4.80
4.4.8
4.4.79
4.4.78
4.4.77
4.4.76
4.4.75
4.4.74
4.4.73
4.4.72
4.4.71
4.4.70
4.4.7
See more versions on NVD

CVSS2 => (AV:A/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
8.3/10
10/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://nvidia.custhelp.com/app/answers/detail/a_id/4561
http://www.debian.org/security/2017/dsa-3981
http://www.securityfocus.com/bid/100809
http://www.securitytracker.com/id/1039373
https://access.redhat.com/errata/RHSA-2017:2704
https://access.redhat.com/errata/RHSA-2017:2705
https://access.redhat.com/errata/RHSA-2017:2706
https://access.redhat.com/errata/RHSA-2017:2707
https://access.redhat.com/errata/RHSA-2017:2731
https://access.redhat.com/errata/RHSA-2017:2732
https://access.redhat.com/security/vulnerabilities/blueborne
https://github.com/torvalds/linux/commit/f2fcfcd670257236ebf2088bbdf26f6a8ef459fe
https://www.armis.com/blueborne
https://www.exploit-db.com/exploits/42762/
https://www.kb.cert.org/vuls/id/240311

Related CVE
CVE-2017-16994
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system c...
CVE-2017-16939
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM...
CVE-2017-12193
The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application...
CVE-2017-12190
The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them int...
CVE-2017-15115
The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possi...
CVE-2017-15102
The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occur...
CVE-2017-6264
An elevation of privilege vulnerability exists in the NVIDIA GPU driver (gm20b_clk_throt_set_cdev_state), where an out of bound memory read is used as a function pointer could lead to code execution in the kernel.This issue is rated as high because i...
CVE-2017-16650
The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.

Copyright 2017, cxsecurity.com

 

Back to Top