A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7265-1 advisory.

    Julian Rauchberger discovered that BlueZ did not correctly handle certain memory operations. An attacker     could possibly use this issue to leak sensitive information or execute arbitrary code. (CVE-2019-8921,     CVE-2019-8922)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2309 advisory.

    An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

    A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3157 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3157-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     October 24, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : bluez     Version        : 5.50-1.2~deb10u3     CVE ID         : CVE-2019-8921 CVE-2019-8922 CVE-2021-41229 CVE-2021-43400                      CVE-2022-0204 CVE-2022-39176 CVE-2022-39177     Debian Bug     : 998626 1000262 1003712

    Several vulnerabilities were discovered in BlueZ, the Linux Bluetooth     protocol stack. An attacker could cause a denial-of-service (DoS) or     leak information.

    CVE-2019-8921

        SDP infoleak, the vulnerability lies in the handling of a         SVC_ATTR_REQ by the SDP implementation of BlueZ. By crafting a         malicious CSTATE, it is possible to trick the server into         returning more bytes than the buffer actually holds, resulting in         leaking arbitrary heap data.

    CVE-2019-8922

        SDP Heap Overflow; this vulnerability lies in the SDP protocol         handling of attribute requests as well. By requesting a huge         number of attributes at the same time, an attacker can overflow         the static buffer provided to hold the response.

    CVE-2021-41229

        sdp_cstate_alloc_buf allocates memory which will always be hung in         the singly linked list of cstates and will not be freed. This will         cause a memory leak over time. The data can be a very large         object, which can be caused by an attacker continuously sending         sdp packets and this may cause the service of the target device to         crash.

    CVE-2021-43400

        A use-after-free in gatt-database.c can occur when a client         disconnects during D-Bus processing of a WriteValue call.

    CVE-2022-0204

        A heap overflow vulnerability was found in bluez. An attacker with         local network access could pass specially crafted files causing an         application to halt or crash, leading to a denial of service.

    CVE-2022-39176

        BlueZ allows physically proximate attackers to obtain sensitive         information because profiles/audio/avrcp.c does not validate         params_len.

    CVE-2022-39177

        BlueZ allows physically proximate attackers to cause a denial of         service because malformed and invalid capabilities can be         processed in profiles/audio/avdtp.c.

    For Debian 10 buster, these problems have been fixed in version     5.50-1.2~deb10u3.

    We recommend that you upgrade your bluez packages.

    For the detailed security status of bluez please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bluez

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3687-1 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3691-1 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bluez packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2948-1 advisory.

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2900-1 advisory.

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2864-1 advisory.

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5183-1 advisory.

    Julian Rauchberger discovered that BlueZ incorrectly handled memory when processing SDP attribute     requests. A remote attacker could use this issue to cause BlueZ to crash, leading to a denial of service,     or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2827 advisory.

    Several vulnerabilities were discovered in BlueZ, the Linux Bluetooth protocol stack. An attacker could     cause a denial-of-service (DoS) or leak information. CVE-2019-8921 SDP infoleak; the vulnerability lies in     the handling of a SVC_ATTR_REQ by the SDP implementation of BlueZ. By crafting a malicious CSTATE, it is     possible to trick the server into returning more bytes than the buffer actually holds, resulting in     leaking arbitrary heap data. CVE-2019-8922 SDP Heap Overflow; this vulnerability lies in the SDP protocol     handling of attribute requests as well. By requesting a huge number of attributes at the same time, an     attacker can overflow the static buffer provided to hold the response. CVE-2021-41229 sdp_cstate_alloc_buf     allocates memory which will always be hung in the singly linked list of cstates and will not be freed.
    This will cause a memory leak over time. The data can be a very large object, which can be caused by an     attacker continuously sending sdp packets and this may cause the service of the target device to crash.
    For Debian 9 stretch, these problems have been fixed in version 5.43-2+deb9u5. We recommend that you     upgrade your bluez packages. For the detailed security status of bluez please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/bluez Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
223062	Linux Distros Unpatched Vulnerability : CVE-2019-8922	Nessus	Misc.	high
216160	Ubuntu 16.04 LTS : BlueZ vulnerabilities (USN-7265-1)	Nessus	Ubuntu Local Security Checks	high
183481	Amazon Linux 2 : bluez (ALAS-2023-2309)	Nessus	Amazon Linux Local Security Checks	high
170504	EulerOS 2.0 SP5 : bluez (EulerOS-SA-2022-1263)	Nessus	Huawei Local Security Checks	high
169620	EulerOS Virtualization 3.0.2.6 : bluez (EulerOS-SA-2023-1090)	Nessus	Huawei Local Security Checks	critical
166429	Debian dla-3157 : bluetooth - security update	Nessus	Debian Local Security Checks	critical
166424	SUSE SLES15 Security Update : bluez (SUSE-SU-2022:3687-1)	Nessus	SuSE Local Security Checks	critical
166417	SUSE SLES15 Security Update : bluez (SUSE-SU-2022:3691-1)	Nessus	SuSE Local Security Checks	critical
165877	EulerOS Virtualization 3.0.6.6 : bluez (EulerOS-SA-2022-2488)	Nessus	Huawei Local Security Checks	critical
164541	SUSE SLES15 Security Update : bluez (SUSE-SU-2022:2948-1)	Nessus	SuSE Local Security Checks	high
164445	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2022:2900-1)	Nessus	SuSE Local Security Checks	high
164335	SUSE SLES15 Security Update : bluez (SUSE-SU-2022:2864-1)	Nessus	SuSE Local Security Checks	high
161589	EulerOS 2.0 SP3 : bluez (EulerOS-SA-2022-1707)	Nessus	Huawei Local Security Checks	critical
160690	EulerOS Virtualization 3.0.2.0 : bluez (EulerOS-SA-2022-1687)	Nessus	Huawei Local Security Checks	critical
158544	EulerOS 2.0 SP9 : bluez (EulerOS-SA-2022-1302)	Nessus	Huawei Local Security Checks	high
158533	EulerOS 2.0 SP9 : bluez (EulerOS-SA-2022-1286)	Nessus	Huawei Local Security Checks	high
155952	Ubuntu 18.04 LTS : BlueZ vulnerability (USN-5183-1)	Nessus	Ubuntu Local Security Checks	high
155712	Debian DLA-2827-1 : bluez - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-8922

high

Tenable Plugins

high

high

high

high

critical

critical

critical

critical

critical

high

high

high

critical

critical

high

high

high

high