#VU68830 Out-of-bounds read in BlueZ - CVE-2019-8921

Vulnerability identifier: #VU68830

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-8921

CWE-ID: CWE-125

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
BlueZ
Universal components / Libraries / Libraries used by multiple products

Vendor: BlueZ Project

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing verification checks when handling consecutive SVC_ATTR_REQ requests within the service_attr_req() function in sdpd-request.c in bluetoothd . A remote attacker on the local network can send specially crafted CSTATE data to the system and trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

BlueZ: 4.0 - 5.48

---

External links
https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/
https://security.netapp.com/advisory/ntap-20211203-0002/
https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.