Date: Fri, 13 Mar 2020 09:27:29 -0400 From: Marc Deslauriers <marc.deslauriers@...onical.com> To: oss-security@...ts.openwall.com Subject: Re: Bluez <5.53 DoS/privilege escalation On 2020-03-12 6:55 p.m., Matthew Garrett wrote: > https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.html > describes a vulnerability in versions below 5.53 of the Bluez > Bluetooth stack. Intel do not appear to have disclosed this issue to > distributions in advance, and have not yet made a release that > includes the fixes. https://patchwork.kernel.org/patch/11428317/ and > https://patchwork.kernel.org/patch/11428319/ should apply to older > versions. > I looks like the patches went into the tree after 5.53, so I'm not sure 5.53 is actually fixed. Does anyone know if there were any other changes in 5.53 that would mitigate the issue? https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=8cdbd3b09f29da29374e2f83369df24228da0ad1 https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=3cccdbab2324086588df4ccf5f892fb3ce1f1787 Marc.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.