CVE-2020-12351, known as "BleedingTooth," is an improper input validation vulnerability in BlueZ, the official Linux Bluetooth stack, affecting the Linux kernel. This high-severity flaw (CVSS 8.8) allows an unauthenticated attacker with adjacent access to achieve escalation of privilege, potentially leading to full compromise of the system without user interaction. While not on the KEV catalog, a public exploit (EDB-49754) exists, and it has garnered significant media attention and community discussion, indicating its potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.7.7, < 4.9.240CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.10, < 4.14.202CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.15, < 4.19.152CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.20, < 5.4.72CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.5, < 5.8.16CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.