[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <db191909-53dd-786f-9b28-200e058917f8@canonical.com>
Date: Fri, 13 Mar 2020 09:27:29 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: Bluez <5.53 DoS/privilege escalation
On 2020-03-12 6:55 p.m., Matthew Garrett wrote:
> https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.html
> describes a vulnerability in versions below 5.53 of the Bluez
> Bluetooth stack. Intel do not appear to have disclosed this issue to
> distributions in advance, and have not yet made a release that
> includes the fixes. https://patchwork.kernel.org/patch/11428317/ and
> https://patchwork.kernel.org/patch/11428319/ should apply to older
> versions.
>
I looks like the patches went into the tree after 5.53, so I'm not sure 5.53 is
actually fixed.
Does anyone know if there were any other changes in 5.53 that would mitigate the
issue?
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=8cdbd3b09f29da29374e2f83369df24228da0ad1
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=3cccdbab2324086588df4ccf5f892fb3ce1f1787
Marc.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
