USN-4592-1

Advisory lineage Upstream: 6 Downstream: 0
Published: 20 Oct 2020, 00:00
Last modified:23 May 2026, 01:31

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Oct 2020, 00:00
Published
Vulnerability first disclosed
23 May 2026, 01:31
Last Modified
Vulnerability information updated

Description

linux-oem-osp1, linux-raspi2-5.3 vulnerabilities Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351) Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352) Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Affected Systems

  • ubuntu•linux-oem-osp1

    < 5.0.0-1070.76

  • ubuntu•linux-raspi2-5.3

    < 5.3.0-1036.38

References (4)