Google researchers discover critical vulnerability in Bluetooth protocol
The vulnerability enables a remote attacker to carry out denial of service attacks or execute arbitrary code in Linux-based devices
Ami Rojkes Dombe
| 21/10/2020
Photo: Bigstock
Security researchers from Google have warned that a new group of Linux Bluetooth software vulnerabilities can enable remote, unauthenticated attackers located nearby to execute arbitrary code with core privileges on vulnerable devices.
These three flaws, according to security engineer Andy Nguyen, collectively called BleedingTooth reside in open-source BlueZ protocol that offers support for many of the core Bluetooth layers and protocols for Linux-based systems such as IoT devices and laptops.
"A remote attacker in short distance knowing the victim's (Bluetooth device) address can send a malicious l2cap packet and cause denial of service or possibly arbitrary code execution with kernel privileges," Google pointed out in its advisory. "Malicious Bluetooth chips can trigger the vulnerability as well."
The vulnerability enables a remote attacker to carry out denial of service attacks or execute arbitrary code in Linux-based devices
Photo: Bigstock
Security researchers from Google have warned that a new group of Linux Bluetooth software vulnerabilities can enable remote, unauthenticated attackers located nearby to execute arbitrary code with core privileges on vulnerable devices.
These three flaws, according to security engineer Andy Nguyen, collectively called BleedingTooth reside in open-source BlueZ protocol that offers support for many of the core Bluetooth layers and protocols for Linux-based systems such as IoT devices and laptops.
"A remote attacker in short distance knowing the victim's (Bluetooth device) address can send a malicious l2cap packet and cause denial of service or possibly arbitrary code execution with kernel privileges," Google pointed out in its advisory. "Malicious Bluetooth chips can trigger the vulnerability as well."
