Medium severity · published Feb 2, 2021
CVE-2020-24490
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access
6.5
CVSS
2.2%
EPSS
No
On KEV
Description
Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Bluez · Bluez
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-24490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-24490
Patch
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00435.html
More from Bluez
9.1
CVE-2021-43400
An issue was discovered in gatt-database.c in BlueZ 5.61
8.8
CVE-2024-8805
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability
8.8
CVE-2022-39177
BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c
8.8
CVE-2022-39176
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len
8.8
CVE-2022-0204
A heap overflow vulnerability was found in bluez in versions prior to 5.63