Disable Bluetooth in cloud kernels
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux-aws (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Xenial |
Invalid
|
Undecided
|
Unassigned | ||
Bionic |
Fix Released
|
Undecided
|
Unassigned | ||
Disco |
Won't Fix
|
Undecided
|
Unassigned | ||
Eoan |
Won't Fix
|
High
|
Unassigned | ||
Focal |
New
|
Undecided
|
Unassigned | ||
Groovy |
Won't Fix
|
Undecided
|
Unassigned | ||
Hirsute |
Won't Fix
|
Undecided
|
Unassigned | ||
linux-gcp (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Xenial |
Triaged
|
High
|
Unassigned | ||
Bionic |
Triaged
|
High
|
Unassigned | ||
Disco |
Won't Fix
|
High
|
Unassigned | ||
Eoan |
Won't Fix
|
High
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Groovy |
Won't Fix
|
Undecided
|
Unassigned | ||
Hirsute |
Fix Released
|
Undecided
|
Unassigned | ||
linux-gke-4.15 (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Xenial |
Invalid
|
Undecided
|
Unassigned | ||
Bionic |
Triaged
|
High
|
Unassigned | ||
Disco |
Invalid
|
Undecided
|
Unassigned | ||
Groovy |
Won't Fix
|
Undecided
|
Unassigned | ||
Hirsute |
Won't Fix
|
Undecided
|
Unassigned | ||
linux-gke-5.0 (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Xenial |
Invalid
|
Undecided
|
Unassigned | ||
Bionic |
Triaged
|
High
|
Unassigned | ||
Disco |
Invalid
|
Undecided
|
Unassigned | ||
Eoan |
Invalid
|
Undecided
|
Unassigned | ||
Focal |
New
|
Undecided
|
Unassigned | ||
Groovy |
Won't Fix
|
Undecided
|
Unassigned | ||
Hirsute |
Won't Fix
|
Undecided
|
Unassigned | ||
linux-oracle (Ubuntu) |
Triaged
|
High
|
Unassigned | ||
Xenial |
Triaged
|
High
|
Unassigned | ||
Bionic |
Triaged
|
High
|
Unassigned | ||
Disco |
Won't Fix
|
High
|
Unassigned | ||
Eoan |
Won't Fix
|
High
|
Unassigned | ||
Focal |
New
|
Undecided
|
Unassigned | ||
Groovy |
Won't Fix
|
Undecided
|
Unassigned | ||
Hirsute |
Won't Fix
|
Undecided
|
Unassigned |
Bug Description
[Impact]
Some cloud-focused kernels have CONFIG_BT enabled but cloud instances shouldn't need bluetooth support. Disabling the bluetooth subsystem reduces the amount of security-sensitive code we have to worry about in the cloud kernels and also has the nice side effect of minimizing build times and kernel sizes.
The cloud kernels known to have bluetooth enabled include:
* [B/D/E] linux-aws (arm64 only)
* [X/B/D/E] linux-gcp
* [B] linux-gke-4.15
* [B] linux-gke-5.0
* [X/B/D/E] linux-oracle
[Test Case]
1. Install patched kernel and reboot into it
2. Ensure that the following command does NOT display any output:
$ grep CONFIG_BT=[my] /boot/config-
[Regression Potential]
There could be an unexpected dependence on bluetooth within one of the clouds but I think it is highly unlikely.
CVE References
Changed in linux-aws (Ubuntu Disco): | |
status: | New → Triaged |
Changed in linux-aws (Ubuntu Bionic): | |
status: | New → Triaged |
description: | updated |
Changed in linux-aws (Ubuntu Xenial): | |
status: | New → Invalid |
Changed in linux-gke-4.15 (Ubuntu Xenial): | |
status: | New → Invalid |
Changed in linux-gke-4.15 (Ubuntu Disco): | |
status: | New → Invalid |
Changed in linux-gke-4.15 (Ubuntu Eoan): | |
status: | New → Invalid |
Changed in linux-gke-5.0 (Ubuntu Xenial): | |
status: | New → Invalid |
Changed in linux-gke-5.0 (Ubuntu Disco): | |
status: | New → Invalid |
Changed in linux-gke-5.0 (Ubuntu Eoan): | |
status: | New → Invalid |
Changed in linux-gke-4.15 (Ubuntu Bionic): | |
status: | New → Triaged |
Changed in linux-gke-5.0 (Ubuntu Bionic): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-gke-4.15 (Ubuntu Bionic): | |
importance: | Undecided → High |
Changed in linux-gcp (Ubuntu Xenial): | |
status: | New → Triaged |
importance: | Undecided → High |
Changed in linux-gcp (Ubuntu Bionic): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-gcp (Ubuntu Disco): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-gcp (Ubuntu Eoan): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-oracle (Ubuntu Xenial): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-oracle (Ubuntu Bionic): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-oracle (Ubuntu Disco): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux-oracle (Ubuntu Eoan): | |
importance: | Undecided → High |
status: | New → Triaged |
description: | updated |
Changed in linux-aws (Ubuntu Disco): | |
status: | Triaged → Won't Fix |
Changed in linux-gcp (Ubuntu Disco): | |
status: | Triaged → Won't Fix |
Changed in linux-oracle (Ubuntu Disco): | |
status: | Triaged → Won't Fix |
Changed in linux-gcp (Ubuntu Focal): | |
status: | New → Fix Committed |
no longer affects: | linux-gke-4.15 (Ubuntu Focal) |
no longer affects: | linux-gke-4.15 (Ubuntu Eoan) |
tags: |
added: verification-done-focal verification-done-hirsute removed: verification-needed-focal verification-needed-hirsute |
The Eoan Ermine has reached end of life, so this bug will not be fixed for that release