CVE-2019-11884: Infoleak
A flaw was found in the kernels implementation of the bluetooth HIDP (Human Interface Device Protocol). A local attacker with access permissions to the bluetooth device can issue an IOCTL which will trigger the dohidpsockioctl function in net/bluetooth/hidp/sock.c.c. This function can potentially leak potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not correctly NULL terminated.
Reference: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.15
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1616a5ac99ede5d605047a9012481ce7ff18b16 https://github.com/torvalds/linux/commit/a1616a5ac99ede5d605047a9012481ce7ff18b16
Other sources
A flaw was found in the Linux kernel's implementation of the Bluetooth Human Interface Device Protocol (HIDP). A local attacker with access permissions to the Bluetooth device can issue an IOCTL which will trigger the dohidpsockioctl function in net/bluetooth/hidp/sock.c.c. This function can leak potentially sensitive information from the kernel stack memory via a HIDPCONNADD command because a name field may not be correctly NULL terminated.
Linux Kernel could allow a local attacker to obtain sensitive information, caused by a flaw in the dohidpsockioctl function in net/bluetooth/hidp/sock.c. By using a HIDPCONNADD command, an attacker could exploit this vulnerability to obtain sensitive information.
— IBM
The dohidpsockioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.rt56.1093.el7 - Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.18.1.el7a - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1127.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.rt24.93.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.el8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.1.177-1Fixed in 6.12.94-1Fixed in 6.12.96-1Fixed in 7.1.3-1Fixed in 7.1.4-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 5.0.15Patch a1616a5ac99ede5d605047a9012481ce7ff18b16 - Compensating control
If you cannot immediately upgrade, prevent untrusted local users from accessing Bluetooth HIDP devices (reduce/contain access permissions to the Bluetooth device and the HIDP interface that can receive the HIDPCONNADD IOCTL).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-11884?
CVE-2019-11884 is classified as a high severity vulnerability due to its potential for exploitation by local attackers with access to Bluetooth devices.
How do I fix CVE-2019-11884?
To fix CVE-2019-11884, update the affected kernel packages to the recommended versions provided by your Linux distribution.
What systems are affected by CVE-2019-11884?
CVE-2019-11884 affects various distributions including Red Hat Enterprise Linux, Fedora, Debian, Ubuntu, and openSUSE with specific versions of the Linux kernel.
Can CVE-2019-11884 be exploited remotely?
CVE-2019-11884 cannot be exploited remotely as it requires local access to the Bluetooth device.
What type of vulnerability is CVE-2019-11884?
CVE-2019-11884 is a privilege escalation vulnerability related to the Bluetooth Human Interface Device Protocol.