CVE-2020-24490 log

Source
Severity Medium
Remote Yes
Type Denial of service
Description
A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Group Package Affected Fixed Severity Status Ticket
AVG-1251 linux-hardened 5.8.14.a-1 5.8.16.a-1 High Fixed
AVG-1250 linux-lts 5.4.71-1 5.4.72-1 High Fixed
AVG-1249 linux-zen 5.9.zen1-1 5.9.1.zen2-1 High Fixed
AVG-1248 linux 5.9.arch1-1 5.9.1.arch1-1 High Fixed
Date Advisory Group Package Severity Type
18 Oct 2020 ASA-202010-9 AVG-1251 linux-hardened High multiple issues
18 Oct 2020 ASA-202010-4 AVG-1250 linux-lts High multiple issues
18 Oct 2020 ASA-202010-3 AVG-1249 linux-zen High multiple issues
18 Oct 2020 ASA-202010-2 AVG-1248 linux High multiple issues
References
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=a2ec905d1e160a33b2e210e45ad30445ef26ce0e