CVE-2019-11884: Infoleak
A flaw was found in the kernels implementation of the bluetooth HIDP (Human Interface Device Protocol). A local attacker with access permissions to the bluetooth device can issue an IOCTL which will trigger the dohidpsockioctl function in net/bluetooth/hidp/sock.c.c. This function can potentially leak potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not correctly NULL terminated.
Reference: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.15
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1616a5ac99ede5d605047a9012481ce7ff18b16 https://github.com/torvalds/linux/commit/a1616a5ac99ede5d605047a9012481ce7ff18b16
Other sources
A flaw was found in the Linux kernel's implementation of the Bluetooth Human Interface Device Protocol (HIDP). A local attacker with access permissions to the Bluetooth device can issue an IOCTL which will trigger the dohidpsockioctl function in net/bluetooth/hidp/sock.c.c. This function can leak potentially sensitive information from the kernel stack memory via a HIDPCONNADD command because a name field may not be correctly NULL terminated.
Linux Kernel could allow a local attacker to obtain sensitive information, caused by a flaw in the dohidpsockioctl function in net/bluetooth/hidp/sock.c. By using a HIDPCONNADD command, an attacker could exploit this vulnerability to obtain sensitive information.
— IBM
The dohidpsockioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-11884?
CVE-2019-11884 is classified as a high severity vulnerability due to its potential for exploitation by local attackers with access to Bluetooth devices.
How do I fix CVE-2019-11884?
To fix CVE-2019-11884, update the affected kernel packages to the recommended versions provided by your Linux distribution.
What systems are affected by CVE-2019-11884?
CVE-2019-11884 affects various distributions including Red Hat Enterprise Linux, Fedora, Debian, Ubuntu, and openSUSE with specific versions of the Linux kernel.
Can CVE-2019-11884 be exploited remotely?
CVE-2019-11884 cannot be exploited remotely as it requires local access to the Bluetooth device.
What type of vulnerability is CVE-2019-11884?
CVE-2019-11884 is a privilege escalation vulnerability related to the Bluetooth Human Interface Device Protocol.