Google said the bug allows seamless code execution by attackers within the Bluetooth range, and Intel is characterising the flaw as providing an escalation of privileges or the disclosure of information.

The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it is used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later.

Dubbed BleedingTooth, by Google engineer Andy Nguyen the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth.

Intel, meanwhile, has issued a bare-bones advisory that categorises the flaw as privilege escalation or information disclosure vulnerability.

The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three specific bugs that comprise BleedingTooth.

“Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure,” the advisory states.

“BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities.” Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday.

Those who can’t upgrade to version 5.9 can install a series of kernel patches.

BleedingTooth requires proximity to a vulnerable device; there is not much reason for people to worry about this vulnerability.  

“It also requires highly specialised knowledge and works on only a tiny fraction of the world’s Bluetooth devices.”