K47455661 : Linux kernel vulnerability CVE-2020-35499

2022-02-2300:00:00

my.f5.com

linux kernel

vulnerability

null pointer dereference

local attacker

crash

leak

kernel internal information

sco sockets

AI Score

6.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Security Advisory Description

A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BT_SNDMTU/BT_RCVMTU for SCO sockets. This could allow a local attacker with a special user privilege to crash the system (DOS) or leak kernel internal information. (CVE-2020-35499)

Impact

There is no impact; F5 products are not affected by this vulnerability.