Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319


Google and Intel are worried about a new Linux vulnerability

Image Description

A new Bluetooth flaw in all but the most recent version of the Linux Kernel has caught the attention of both Google and Intel which have both issued warnings about its severity.

The flaw itself resides in the BlueZ software stack that is used to implement Bluetooth core protocols and layers in Linux. In addition to being used in Linux laptops, the software stack is also used in many consumer devices as well as industrial IoT devices.

Google engineer Andy Nguyen has given the vulnerability the name BleedingTooth and in a recent tweet, he explained that it is actually “a set of zero-click vulnerabilities in the Linux Bluetooth subsystem that can allow an unauthenticated remote attacker in short distance to execute arbitrary code with kernel privileges on vulnerable devices”.

According to Nguyen, he was inspired by research that led to the discovery of another proof-of-concept exploit called BlueBorne that allows an attacker to send commands without requiring a user to click on links.


Although Nguyen has said that BleedingTooth allows seamless code execution by attackers within Bluetooth range, Intel instead believes the flaw provides a means for an attacker to achieve privilege escalation or to disclose information.

The chip giant has also issued an advisory in which it explained that BleedingTooth is actually comprised of three separate vulnerabilities tracked as CVE-2020-12351, CVE-2020-12352 and CVE-2020-24490. While the first vulnerability has a high-severity CVSS score of 8.3, the other two both have CVSS scores of 5.3. In its BlueZ advisory, Intel explained that Linux kernel fixes will be released soon, saying:

“Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure. BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities.”

Intel itself is one of the main contributors to the BlueZ open source project and according to the chipmaker, a series of kernel patches is the only way to address BleedingTooth. While concerning, the vulnerability isn't the kind of thing users should be afraid of as an attacker would need to be in close proximity of a vulnerable Linux device to exploit BleedingTooth.

Via Ars Technica


16 Oct 2020



Other Blog

  • Apple to debut A14X chips based on M1 on new iPad Pros

    Apple is apparently set to introduce the A14X chips which are based on its M1 chips on the new iPad Pros which are set to launch soon.

    Read More
  • Disappearing chats are just a Honk away - but there's a catch

    Aimed completely at the millennials

    Read More
  • Coinbase files for historic IPO amid Bitcoin surge

    Coinbase is preparing to go public but it's still unclear as to whether the company will do so via an IPO or direct listing.

    Read More
  • This 2.65-liter Zotac workstations pack 6-core CPU and Nvidia Quadro GPU

    UCFF workstation for creative professionals.

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us