CVE-2020-0556 - log back

CVE-2020-0556 edited at 19 Mar 2020 15:22:21
Description
It was discovered that the HID and HOGP profiles implementations in bluez before 5.54 don't specifically require bonding between the device and the host. This creates an opportunity for a malicious device to connect to a target host to either impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem from a non-bonded source.
- This potentially enables escalation of privilege and denial of service via adjacent access.
+ This potentially enables an unauthenticated attacker with adjacent access to impersonate an existing HID device, cause a denial of service or escalate privileges.
CVE-2020-0556 edited at 19 Mar 2020 09:55:44
Description
- It was discovered that the HID and HOGP profiles implementations in bluez before 5.54 don't specifically require bonding between the device and the host. This creates an opportunity for a malicious device to connect to a target host to either impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem froma non-bonded source.
+ It was discovered that the HID and HOGP profiles implementations in bluez before 5.54 don't specifically require bonding between the device and the host. This creates an opportunity for a malicious device to connect to a target host to either impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem from a non-bonded source.
This potentially enables escalation of privilege and denial of service via adjacent access.
CVE-2020-0556 edited at 17 Mar 2020 13:20:29
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Access restriction bypass
Description
+ It was discovered that the HID and HOGP profiles implementations in bluez before 5.54 don't specifically require bonding between the device and the host. This creates an opportunity for a malicious device to connect to a target host to either impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem froma non-bonded source.
+ This potentially enables escalation of privilege and denial of service via adjacent access.
References
+ https://lore.kernel.org/linux-bluetooth/20200310023516.209146-1-alainm@chromium.org/
+ https://patchwork.kernel.org/patch/11428317/
+ https://patchwork.kernel.org/patch/11428319/
+ https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=8cdbd3b09f29da29374e2f83369df24228da0ad1
+ https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=3cccdbab2324086588df4ccf5f892fb3ce1f1787
Notes
CVE-2020-0556 created at 17 Mar 2020 13:17:04