CVE-2020-25662 Information disclosure in kernel
A remote attacker in adjacent range can leak stack memory by sending crafted AMP packets to the Linux kernel Bluetooth stack.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25662?
CVE-2020-25662 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 5 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.
Which versions are affected by CVE-2020-25662?
It affects 1 product.
Products include Redhat Enterprise Linux.
How do I fix CVE-2020-25662?
Apply the vendor's patch.
Is CVE-2020-25662 being exploited?
There is no known exploitation of CVE-2020-25662 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
Sources
Also known as GHSA-6v9p-cxvf-8f7v, UBUNTU-CVE-2020-25662.