Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices
Oct 16, 2020
Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices. According to security engineer Andy Nguyen , the three flaws — collectively called BleedingTooth — reside in the open-source BlueZ protocol stack that offers support for many of the core Bluetooth layers and protocols for Linux-based systems such as laptops and IoT devices. The first and the most severe is a heap-based type confusion ( CVE-2020-12351 , CVSS score 8.3) affecting Linux kernel 4.8 and higher and is present in the Logical Link Control and Adaptation Protocol ( L2CAP ) of the Bluetooth standard, which provides multiplexing of data between different higher layer protocols. "A remote attacker in short distance knowing the victim's [Bluetooth device] address can send a malicious l2cap packet and cause denial ...
