Out-of-bounds read in BlueZ - CVE-2023-51592

Vulnerability identifier: #VU84665

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-51592

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when handling AVRCP protocol within the parse_media_folder() function. A remote attacker can trick the victim into connecting to a malicious device, trigger an out-of-bounds read and gain access to sensitive information.

BlueZ
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Fedora
libell
iwd
bluez (Red Hat package)
bluez
bluez-cups
bluez-hid2hci
bluez-libs
bluez-libs-devel
bluez-mesh
bluez-obexd
bluez-doc
OpenShift API for Data Protection (OADP)
Red Hat OpenShift Dev Spaces
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component

Install updates from vendor's website.

BlueZ - update to 5.71
libell - update to 0.74-1.fc42
OpenShift API for Data Protection (OADP) - addressed in versions 1.3.4, 1.4.2
iwd - update to 3.4-1.fc42
Red Hat OpenShift Dev Spaces - update to 3.17.0
watsonx Assistant Cartridge - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
bluez (Red Hat package) - update to 5.72-2.el9
bluez - update to 5.80-1.fc42
bluez - update to 5.82-1
bluez-cups - update to 5.82-1
bluez-hid2hci - update to 5.82-1
bluez-libs - update to 5.82-1
bluez-libs-devel - update to 5.82-1
bluez-mesh - update to 5.82-1
bluez-obexd - update to 5.82-1
bluez-doc - update to 5.82-1

• https://www.zerodayinitiative.com/advisories/ZDI-23-1905/

• Multiple vulnerabilities in BlueZ
• Red Hat Enterprise Linux 9 update for bluez
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Fedora 42 update for bluez, iwd, libell
• Anolis OS update for bluez