CVE-2012-6544

Published: 07 March 2013

The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation.

From the Ubuntu security team

Mathias Krause discovered information leaks in the Linux kernel's Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A local user could exploit these flaws to examine some of the kernel's stack memory.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6544
• http://www.openwall.com/lists/oss-security/2013/03/07
• http://www.openwall.com/lists/oss-security/2013/03/07/2
• https://ubuntu.com/security/notices/USN-1648-1
• https://ubuntu.com/security/notices/USN-1649-1
• https://ubuntu.com/security/notices/USN-1652-1
• https://ubuntu.com/security/notices/USN-1610-1
• https://ubuntu.com/security/notices/USN-1599-1
• https://ubuntu.com/security/notices/USN-1805-1
• https://ubuntu.com/security/notices/USN-1808-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1156751