PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2019-3459

CVE-2019-3459

kernel: Heap address information leak while using L2CAP_GET_CONF_OPT

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.0

Review impact separately from score.

Published · January 11, 2019

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's implementation of Logical Link Control and Adaptation Protocol (L2CAP), part of the Bluetooth stack. An attacker, within the range of standard Bluetooth transmissions, can create and send a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

  • Disabling the bluetooth hardware in the bios.
  • Prevent loading of the bluetooth kernel modules.
  • Disable the bluetooth connection by putting the system in "airport" mode.

CVSS / CWE

CVSS 3.0 · 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor