CVE-2017-1000251
En bref
- Source
- NVD
- EPSS
- EPSS 16.18 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
- https://access.redhat.com/errata/RHSA-2017:2732
- https://www.exploit-db.com/exploits/42762/
- https://access.redhat.com/errata/RHSA-2017:2705
- https://access.redhat.com/errata/RHSA-2017:2683
- https://access.redhat.com/errata/RHSA-2017:2704
- https://access.redhat.com/errata/RHSA-2017:2682
- https://access.redhat.com/security/vulnerabilities/blueborne
- https://www.armis.com/blueborne
- http://www.securitytracker.com/id/1039373
- https://access.redhat.com/errata/RHSA-2017:2731
- http://www.debian.org/security/2017/dsa-3981
- https://access.redhat.com/errata/RHSA-2017:2706
- https://www.synology.com/support/security/Synology_SA_17_52_BlueBorne
- https://github.com/torvalds/linux/commit/f2fcfcd670257236ebf2088bbdf26f6a8ef459fe
- http://nvidia.custhelp.com/app/answers/detail/a_id/4561
- http://www.securityfocus.com/bid/100809
- https://www.kb.cert.org/vuls/id/240311
- https://access.redhat.com/errata/RHSA-2017:2681
- https://access.redhat.com/errata/RHSA-2017:2679
- https://access.redhat.com/errata/RHSA-2017:2680
- https://access.redhat.com/errata/RHSA-2017:2707
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.7 | AV:A/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-1512
- GCVE · GCVE-0-2017-1000251
Avis du CERT-FR
- CERTFR-2018-AVI-014 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2017-AVI-400 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2017-AVI-374 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2017-AVI-362 — Multiples vulnérabilités dans NVIDIA Tegra Jetson L4T · cert.ssi.gouv.fr
- CERTFR-2017-AVI-338 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2017-AVI-307 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2017-AVI-306 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2017-AVI-301 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2017-AVI-291 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 2.6.32 < 3.2.94cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.3 < 3.16.49cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.17 < 3.18.71cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 3.19 < 4.1.45cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.2 < 4.4.88cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.5 < 4.9.50cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10 < 4.12.13cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.13 < 4.13.2cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:nvidia:jetson_tk1:r21:*:*:*:*:*:*:*cpe:2.3:a:nvidia:jetson_tk1:r24:*:*:*:*:*:*:*cpe:2.3:a:nvidia:jetson_tx1:r21:*:*:*:*:*:*:*cpe:2.3:a:nvidia:jetson_tx1:r24:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*- +2 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |