Buffer overflow in Linux kernel - CVE-2020-24490

Vulnerability identifier: #VU47549

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-24490

CWE-ID: CWE-119

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within BlueZ  implementation in Linux kernel. A remote attacker on the local network can pass specially crated data to the system and perform a denial of service (DoS) attack.

Linux kernel
Arch Linux
Slackware Linux
Ubuntu
openEuler
linux-image-4.4.0-262-generic (Ubuntu package)
linux-image-4.4.0-262-lowlatency (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-4.4.240/kernel-modules
linux-4.4.240/kernel-generic
linux-4.4.240/kernel-huge
linux-4.4.240/kernel-headers
kernel-debugsource
perf
kernel-source
python2-perf-debuginfo
kernel-tools-debuginfo
kernel-devel
kernel-tools-devel
bpftool-debuginfo
python3-perf
python2-perf
python3-perf-debuginfo
perf-debuginfo
kernel-debuginfo
kernel
bpftool
kernel-tools
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.0.0-1070-oem-osp1 (Ubuntu package)
linux-image-raspi2-hwe-18.04 (Ubuntu package)
linux-image-5.3.0-1036-raspi2 (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1048-oem (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-128-lowlatency (Ubuntu package)
linux-image-5.15.0-128-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-5.15.0-130-generic-lpae (Ubuntu package)
linux-image-5.15.0-130-generic-64k (Ubuntu package)
linux-image-5.15.0-130-generic (Ubuntu package)
linux-image-oem-20.04d (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-oem-20.04c (Ubuntu package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-5.15.0-1041-xilinx-zynqmp (Ubuntu package)
linux-image-xilinx-zynqmp (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-5.15.0-1057-gkeop (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-5.15.0-1067-ibm (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-nvidia-lowlatency (Ubuntu package)
linux-image-nvidia (Ubuntu package)
linux-image-5.15.0-1070-nvidia (Ubuntu package)
linux-image-5.15.0-1070-nvidia-lowlatency (Ubuntu package)
linux-image-5.15.0-1070-raspi (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.15.0-1071-kvm (Ubuntu package)
linux-image-5.15.0-1071-intel-iotg (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-5.15.0-1072-gke (Ubuntu package)
linux-image-5.15.0-1072-oracle (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-oracle-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1073-oracle (Ubuntu package)
linux-image-gcp-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1074-gcp (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-5.15.0-1075-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-aws-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1076-aws (Ubuntu package)
linux-image-azure-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1078-azure (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-cvm (Ubuntu package)
linux-image-intel-iotg (Ubuntu package)
linux-image-intel (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.9.0
linux-image-4.4.0-262-generic (Ubuntu package) - addressed in versions Ubuntu Pro, linux-image-4.4.0-262-lowlatency
linux-image-4.4.0-262-lowlatency (Ubuntu package) - update to Ubuntu Pro
linux-image-generic (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.15.0.130.128
linux-image-generic-lts-xenial (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), linux-image-lowlatency-lts-xenial
linux-image-lowlatency (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.15.0.128.116
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.15.0.130.128
linux-image-virtual-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-4.4.240/kernel-modules - update to 4.4.240
linux-4.4.240/kernel-generic - update to 4.4.240
linux-4.4.240/kernel-huge - update to 4.4.240
linux-4.4.240/kernel-headers - update to 4.4.240_smp
kernel-debugsource - update to 4.19.90-2011.6.0.0049
perf - update to 4.19.90-2011.6.0.0049
kernel-source - update to 4.19.90-2011.6.0.0049
python2-perf-debuginfo - update to 4.19.90-2011.6.0.0049
kernel-tools-debuginfo - update to 4.19.90-2011.6.0.0049
kernel-devel - update to 4.19.90-2011.6.0.0049
kernel-tools-devel - update to 4.19.90-2011.6.0.0049
bpftool-debuginfo - update to 4.19.90-2011.6.0.0049
python3-perf - update to 4.19.90-2011.6.0.0049
python2-perf - update to 4.19.90-2011.6.0.0049
python3-perf-debuginfo - update to 4.19.90-2011.6.0.0049
perf-debuginfo - update to 4.19.90-2011.6.0.0049
kernel-debuginfo - update to 4.19.90-2011.6.0.0049
kernel - update to 4.19.90-2011.6.0.0049
bpftool - update to 4.19.90-2011.6.0.0049
kernel-tools - update to 4.19.90-2011.6.0.0049
linux-image-oem-osp1 (Ubuntu package) - update to 5.0.0.1070.68
linux-image-5.0.0-1070-oem-osp1 (Ubuntu package) - update to 5.0.0-1070.76
linux-image-raspi2-hwe-18.04 (Ubuntu package) - update to 5.3.0.1036.25
linux-image-5.3.0-1036-raspi2 (Ubuntu package) - update to 5.3.0-1036.38
linux-image-oem-20.04 (Ubuntu package) - addressed in versions 5.6.0.1048.44, 5.15.0.130.140~20.04.1
linux-image-5.6.0-1048-oem (Ubuntu package) - update to 5.6.0-1048.52
linux-image-lowlatency-64k (Ubuntu package) - update to 5.15.0.128.116
linux-image-5.15.0-128-lowlatency (Ubuntu package) - addressed in versions 5.15.0-128.138, 5.15.0-128.138~20.04.1
linux-image-5.15.0-128-lowlatency-64k (Ubuntu package) - addressed in versions 5.15.0-128.138, 5.15.0-128.138~20.04.1
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.128.138~20.04.1
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.15.0.128.138~20.04.1
linux-image-generic-64k (Ubuntu package) - update to 5.15.0.130.128
linux-image-generic-lpae (Ubuntu package) - update to 5.15.0.130.128
linux-image-5.15.0-130-generic-lpae (Ubuntu package) - addressed in versions 5.15.0-130.140, 5.15.0-130.140~20.04.1
linux-image-5.15.0-130-generic-64k (Ubuntu package) - addressed in versions 5.15.0-130.140, 5.15.0-130.140~20.04.1
linux-image-5.15.0-130-generic (Ubuntu package) - addressed in versions 5.15.0-130.140, 5.15.0-130.140~20.04.1
linux-image-oem-20.04d (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-oem-20.04c (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-oem-20.04b (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.130.140~20.04.1
linux-image-5.15.0-1041-xilinx-zynqmp (Ubuntu package) - update to 5.15.0-1041.45
linux-image-xilinx-zynqmp (Ubuntu package) - update to 5.15.0.1041.45
linux-image-gkeop (Ubuntu package) - update to 5.15.0.1057.56
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1057.56
linux-image-5.15.0-1057-gkeop (Ubuntu package) - update to 5.15.0-1057.64
linux-image-ibm (Ubuntu package) - addressed in versions 5.15.0.1067.63, 5.15.0.1067.70~20.04.1
linux-image-5.15.0-1067-ibm (Ubuntu package) - addressed in versions 5.15.0-1067.70, 5.15.0-1067.70~20.04.1
linux-image-raspi-nolpae (Ubuntu package) - update to 5.15.0.1070.68
linux-image-raspi (Ubuntu package) - update to 5.15.0.1070.68
linux-image-nvidia-lowlatency (Ubuntu package) - update to 5.15.0.1070.70
linux-image-nvidia (Ubuntu package) - update to 5.15.0.1070.70
linux-image-5.15.0-1070-nvidia (Ubuntu package) - update to 5.15.0-1070.71
linux-image-5.15.0-1070-nvidia-lowlatency (Ubuntu package) - update to 5.15.0-1070.71
linux-image-5.15.0-1070-raspi (Ubuntu package) - update to 5.15.0-1070.73
linux-image-kvm (Ubuntu package) - update to 5.15.0.1071.67
linux-image-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1071.71, 5.15.0.1071.77~20.04.1
linux-image-5.15.0-1071-kvm (Ubuntu package) - update to 5.15.0-1071.76
linux-image-5.15.0-1071-intel-iotg (Ubuntu package) - addressed in versions 5.15.0-1071.77, 5.15.0-1071.77~20.04.1
linux-image-intel (Ubuntu package) - update to 5.15.0.1071.77~20.04.1
linux-image-gke-5.15 (Ubuntu package) - update to 5.15.0.1072.71
linux-image-gke (Ubuntu package) - update to 5.15.0.1072.71
linux-image-5.15.0-1072-gke (Ubuntu package) - update to 5.15.0-1072.78
linux-image-5.15.0-1072-oracle (Ubuntu package) - update to 5.15.0-1072.78~20.04.1
linux-image-oracle (Ubuntu package) - update to 5.15.0.1072.78~20.04.1
linux-image-oracle-lts-22.04 (Ubuntu package) - update to 5.15.0.1073.69
linux-image-5.15.0-1073-oracle (Ubuntu package) - update to 5.15.0-1073.79
linux-image-gcp-lts-22.04 (Ubuntu package) - update to 5.15.0.1074.70
linux-image-5.15.0-1074-gcp (Ubuntu package) - addressed in versions 5.15.0-1074.83, 5.15.0-1074.83~20.04.1
linux-image-gcp (Ubuntu package) - update to 5.15.0.1074.83~20.04.1
linux-image-5.15.0-1075-aws (Ubuntu package) - update to 5.15.0-1075.82~20.04.1
linux-image-aws (Ubuntu package) - update to 5.15.0.1075.82~20.04.1
linux-image-aws-lts-22.04 (Ubuntu package) - update to 5.15.0.1076.78
linux-image-5.15.0-1076-aws (Ubuntu package) - update to 5.15.0-1076.83
linux-image-azure-lts-22.04 (Ubuntu package) - update to 5.15.0.1078.76
linux-image-5.15.0-1078-azure (Ubuntu package) - update to 5.15.0-1078.87~20.04.1
linux-image-azure (Ubuntu package) - update to 5.15.0.1078.87~20.04.1
linux-image-azure-cvm (Ubuntu package) - update to 5.15.0.1078.87~20.04.1

• Exploit #9794 - linux_CVE-2020-24490-beforePatch () (May 13, 2024)

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
• https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz@gmail.com/
• https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz@gmail.com/
• https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-3-luiz.dentz@gmail.com/
• https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-4-luiz.dentz@gmail.com/
• https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=a2ec905d1e160a33b2e210e45ad30445ef26ce0e

• Multiple vulnerabilities in BlueZ implementation in Linux kernel
• Arch Linux update for linux-lts
• Arch Linux update for linux-zen
• Arch Linux update for Linux
• Arch Linux update for linux-hardened
• Ubuntu update for linux-oem-5.6
• Ubuntu update for linux
• Ubuntu update for linux-intel-iotg
• Ubuntu update for linux-aws
• Ubuntu update for linux
• Ubuntu update for linux-gke
• Ubuntu update for linux-azure-5.15
• Ubuntu update for linux-azure
• Ubuntu update for linux-xilinx-zynqmp
• Ubuntu update for linux-oem-osp1
• Slackware Linux update for kernel
• openEuler 20.03 LTS update for kernel