Out-of-bounds read in Red Hat Enterprise Linux for x86_64 - CVE-2017-1000250

Vulnerability identifier: #VU8442

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-1000250

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The weakness exists in the bluetoothd implementation of the Service Discovery Protocol (SDP) due to out-of-bounds heap read condition in the service_search_attr_req function. An adjacent attacker send specially crafted requests that has Bluetooth enabled in the SDP server and access sensitive information, such as encryption keys, from bluetoothd process memory.

Successful exploitation of the vulnerability results in information disclosure.

Red Hat Enterprise Linux for x86_64
Arch Linux
Debian Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Ubuntu
Fedora
bluez (Alpine package)
bluez

Cybersecurity Help is currently unaware of any official patch addressing the vulnerability.

bluez (Alpine package) - update to 5.36-r1
bluez - addressed in versions 5.46-6.fc26, 5.46-6.fc27

• Exploit #159 - CVE-2017-1000250-PoC (Proof of concept exploit script for CVE-2017-1000250. Written while researching for the essay in TTM4137 Wireless Security.) (March 18, 2020)

• https://access.redhat.com/security/cve/CVE-2017-1000250

• Information disclosure in Red Hat Enterprise Linux
• Arch Linux update for bluez
• Ubuntu update for BlueZ
• Debian update for bluez
• Slackware Linux update for bluez
• Red Hat update for bluez
• Out-of-bounds read in bluez (Alpine package)
• Fedora 27 update for bluez
• Fedora 26 update for bluez