CVE-2020-25662

low-risk
Published 2020-11-05

A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.

Do I need to act?

-
0.76% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
ADJACENT_NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Redhat

References (6)

Mitigation https://access.redhat.com/security/cve/CVE-2020-12352
Vendor Advisory https://access.redhat.com/security/vulnerabilities/BleedingTooth
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25662
Mitigation https://access.redhat.com/security/cve/CVE-2020-12352
Vendor Advisory https://access.redhat.com/security/vulnerabilities/BleedingTooth
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25662
22
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 3/34 · Minimal
Exposure 5/34 · Minimal