Linux Bluetooth Vulnerability Could Allow Escalation of Privileges

Summary

Intel is warning of a high-severity vulnerability affecting the Bluetooth stack in Linux kernel versions prior to 5.9 that support BlueZ, typically found in Linux-based IoT devices. The improper input validation vulnerability, CVE-2020-12351, could allow an unauthorized user to escalate privileges. Proof-of-concept exploits have been developed against this vulnerability. Several other vulnerabilities were patched, some of which could enable an attacker to cause a denial-of-service condition.

Recommendations

The NJCCIC recommends updating Linux kernels to version 5.9 after appropriate testing and keeping Bluetooth disabled when not needed. More information can be found in the Intel Security Advisory.