Out-of-bounds read in BlueZ - CVE-2019-8921

Vulnerability identifier: #VU68830

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8921

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing verification checks when handling consecutive SVC_ATTR_REQ requests within the service_attr_req() function in sdpd-request.c in bluetoothd . A remote attacker on the local network can send specially crafted CSTATE data to the system and trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data.

BlueZ
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
Ubuntu
libbluetooth3 (Ubuntu package)
bluez (Ubuntu package)
bluez-debuginfo
bluez-devel
bluez-cups-debuginfo
libbluetooth3-debuginfo
bluez
bluez-debugsource
libbluetooth3
bluez-cups

Install updates from vendor's website.

BlueZ - update to 5.49
libbluetooth3 (Ubuntu package) - update to Ubuntu Pro
bluez (Ubuntu package) - update to Ubuntu Pro
bluez-debuginfo - addressed in versions 5.13-5.31.1, 5.48-150000.5.41.1, 5.48-150200.13.17.1
bluez-devel - addressed in versions 5.13-5.31.1, 5.48-150000.5.41.1, 5.48-150200.13.17.1
bluez-cups-debuginfo - update to 5.13-5.31.1
libbluetooth3-debuginfo - addressed in versions 5.13-5.31.1, 5.48-150000.5.41.1, 5.48-150200.13.17.1
bluez - addressed in versions 5.13-5.31.1, 5.48-150000.5.41.1, 5.48-150200.13.17.1
bluez-debugsource - addressed in versions 5.13-5.31.1, 5.48-150000.5.41.1, 5.48-150200.13.17.1
libbluetooth3 - addressed in versions 5.13-5.31.1, 5.48-150000.5.41.1, 5.48-150200.13.17.1
bluez-cups - update to 5.13-5.31.1

• https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/
• https://security.netapp.com/advisory/ntap-20211203-0002/
• https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html

• Multiple vulnerabilities in BlueZ
• SUSE update for bluez
• SUSE update for bluez
• SUSE update for bluez
• Ubuntu update for bluez