CVE-2020-12352: linux linux_kernel Missing Initialization of Resource

Modified

AliasesRHSA-2020:4990RHSA-2020:4991UBUNTU-CVE-2020-12352+1 more

Published 23-11-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-12352 is a medium (CVSS 6.5) Missing Initialization of Resource vulnerability in linux linux_kernel. EPSS estimates a 5.71% chance of exploitation in the next 30 days, higher than 93% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 6.5, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

5.71%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Timeline

23-11-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.16.5v2.03.3

EPSS trend

Probability

5.71%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.71% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaseremotelinuxUnverified
Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-909Missing Initialization of ResourceThe product does not initialize a critical resource.

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu49 products

linuxAll versions (No fix recorded) | < 4.4.0-262.296 | < 4.15.0-122.124 | < 5.4.0-52.57 | < 5.15.0-130.140 | < 6.8.0-35.35
linux-aws< 5.15.0-1076.83 | < 6.8.0-1009.9
linux-aws-5.15< 5.15.0-1075.82~20.04.1
linux-aws-fips< 4.15.0-2031.32 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2 | < 5.15.0-1076.83+fips1
linux-azure< 5.15.0-1078.87 | < 6.8.0-1008.8

linux-azure-5.15< 5.15.0-1078.87~20.04.1
linux-azure-fdeAll versions (No fix recorded) | < 5.15.0-1078.87.1
linux-azure-fips< 4.15.0-2013.15 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1 | < 5.15.0-1078.87+fips1
linux-bluefield< 5.15.0-1058.60
linux-fips< 4.4.0-1108.115 | All versions (No fix recorded) | < 4.15.0-1045.52 | < 5.15.0-128.138+fips1
linux-gcp< 5.15.0-1074.83 | < 6.8.0-1008.9
linux-gcp-5.15< 5.15.0-1074.83~20.04.1
linux-gcp-fipsAll versions (No fix recorded) | < 5.4.0-1067.71~20.04.1 | < 5.15.0-1073.81+fips1
linux-gkeAll versions (No fix recorded) | < 5.15.0-1072.78 | < 6.8.0-1004.7
linux-gkeop< 5.15.0-1057.64
linux-hwe< 4.15.0-122.124~16.04.1 | All versions (No fix recorded)
linux-hwe-5.15< 5.15.0-130.140~20.04.1
linux-hwe-5.4< 5.4.0-52.57~18.04.1
linux-hwe-5.8< 5.8.0-25.26~20.04.1
linux-hwe-edgeAll versions (No fix recorded)
linux-ibm< 5.15.0-1067.70 | < 6.8.0-1006.6
linux-ibm-5.15< 5.15.0-1067.70~20.04.1
linux-intel-iot-realtime< 5.15.0-1071.73
linux-intel-iotg< 5.15.0-1071.77
linux-intel-iotg-5.15< 5.15.0-1071.77~20.04.1
linux-kvm< 5.15.0-1071.76
linux-lowlatency< 5.15.0-128.138 | < 6.8.0-35.35.1
linux-lowlatency-hwe-5.15< 5.15.0-128.138~20.04.1
linux-lts-xenial< 4.4.0-262.296~14.04.1
linux-nvidia< 5.15.0-1070.71
linux-nvidia-tegra< 5.15.0-1032.32
linux-nvidia-tegra-5.15< 5.15.0-1032.32~20.04.1
linux-nvidia-tegra-igx< 5.15.0-1020.20
linux-oem< 4.15.0-1100.110
linux-oem-5.6< 5.6.0-1032.33
linux-oem-6.8< 6.8.0-1006.6
linux-oem-osp1< 5.0.0-1071.77
linux-oracle< 5.15.0-1073.79 | < 6.8.0-1006.6
linux-oracle-5.15< 5.15.0-1072.78~20.04.1
linux-raspi< 5.4.0-1022.25 | < 5.15.0-1070.73 | < 6.8.0-1005.5
linux-raspi-5.4< 5.4.0-1022.25~18.04.1
linux-raspi-realtime< 6.8.0-2004.4
linux-raspi2< 4.4.0-1142.152 | < 4.15.0-1074.79 | All versions (No fix recorded)
linux-raspi2-5.3< 5.3.0-1036.38
linux-realtimeAll versions (No fix recorded) | < 5.15.0-1075.83 | < 6.8.1-1002.2
linux-riscv< 5.4.0-37.42 | All versions (No fix recorded) | < 6.8.0-35.35.1
linux-riscv-5.15< 5.15.0-1070.74~20.04.1
linux-snapdragon< 4.4.0-1146.156 | < 4.15.0-1090.99
linux-xilinx-zynqmp< 5.15.0-1041.45

Show all 49

Redhat19 products

kernel< 0:3.10.0-327.93.1.el7 | < 0:3.10.0-514.85.1.el7
kernel-abi-whitelists< 0:3.10.0-327.93.1.el7 | < 0:3.10.0-514.85.1.el7
kernel-bootwrapper< 0:3.10.0-514.85.1.el7
kernel-debug< 0:3.10.0-327.93.1.el7 | < 0:3.10.0-514.85.1.el7
kernel-debug-debuginfo< 0:3.10.0-327.93.1.el7 | < 0:3.10.0-514.85.1.el7

Show all 19

Debian1 product

linux< 5.9.1-1

Linux1 product

linux_kernel≥ 5.4, < 5.4.72 | ≥ 5.8.0, < 5.8.16 | ≥ 5.9.0, ≤ 5.9.13

4 vendors · 70 products

References

30 links

www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html?wapkw=CVE-2020-12351X Refsource MISCThird Party Advisory
packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/162131/Linux-Kernel-5.4-BleedingTooth-Remote-Code-Execution.htmlX Refsource MISCThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2020:4990Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/security/vulnerabilities/BleedingToothARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1886529REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4990.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-12352REPORT
www.cve.org/CVERecord?id=CVE-2020-12352AdvisoryREPORT

Show all 30 references

nvd.nist.gov/vuln/detail/CVE-2020-12352Advisory
github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrqARTICLEREPORT
lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/ARTICLEREPORT
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.htmlARTICLEREPORT
access.redhat.com/errata/RHSA-2020:4991Advisory
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4991.jsonAdvisory
ubuntu.com/security/CVE-2020-12352REPORT
git.kernel.org/linus/eddb7732119d53400f48a02536a84c509692faa8REPORT
ubuntu.com/security/notices/USN-4592-1Advisory
ubuntu.com/security/notices/USN-4591-1Advisory
ubuntu.com/security/notices/USN-4657-1Advisory
ubuntu.com/security/notices/USN-7179-1Advisory
ubuntu.com/security/notices/USN-7179-2Advisory
ubuntu.com/security/notices/USN-7183-1Advisory
ubuntu.com/security/notices/USN-7186-1Advisory
ubuntu.com/security/notices/USN-7179-3Advisory
ubuntu.com/security/notices/USN-7186-2Advisory
ubuntu.com/security/notices/USN-7194-1Advisory
ubuntu.com/security/notices/USN-7179-4Advisory
security-tracker.debian.org/tracker/CVE-2020-12352Advisory