diff options
| author |   Anuj Mittal <anuj.mittal@intel.com> | 2020-03-13 09:09:38 +0800 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-03-13 13:35:58 +0000 |
| commit | d598f8eee0741148416e8660e10c716654205cb5 (patch) | |
| tree | d40028bc7f5530304e9fe941b9974f5ea92a7d3c /meta/recipes-connectivity/bluez5/bluez5.inc | |
| parent | caf80e4e245132bdc3bbe219b567013f2c5d2f46 (diff) | |
| download | openembedded-core-contrib-d598f8eee0741148416e8660e10c716654205cb5.tar.gz | |
bluez: fix CVE-2020-0556
It was discovered that BlueZ's HID and HOGP profiles implementations
don't specifically require bonding between the device and the host.
This creates an opportunity for an malicious device to connect to a
target host to either impersonate an existing HID device without
security or to cause an SDP or GATT service discovery to take place
which would allow HID reports to be injected to the input subsystem from
a non-bonded source.
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/bluez5/bluez5.inc')
| -rw-r--r-- | meta/recipes-connectivity/bluez5/bluez5.inc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index 150d909d73..708fa1ccec 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -52,6 +52,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '', 'file://0001-Allow-using-obexd-without-systemd-in-the-user-sessio.patch', d)} \ file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \ file://0001-test-gatt-Fix-hung-issue.patch \ + file://CVE-2020-0556-1.patch \ + file://CVE-2020-0556-2.patch \ " S = "${WORKDIR}/bluez-${PV}" |