BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0167-1 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0166-1 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has bluez packages installed that are affected by a vulnerability:

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2081 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3689-1 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3240-1 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3238-1 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3157 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:2081 advisory.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:2081 advisory.

  - bluez: memory leak in the SDP protocol (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:2081 advisory.

  - bluez: memory leak in the SDP protocol (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the bluez package has been released.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2827 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.04 / 21.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5155-1 advisory.

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
189256	SUSE SLES15 Security Update : bluez (SUSE-SU-2024:0167-1)	Nessus	SuSE Local Security Checks	medium
189255	SUSE SLES15 Security Update : bluez (SUSE-SU-2024:0166-1)	Nessus	SuSE Local Security Checks	medium
187353	NewStart CGSL MAIN 6.06 : bluez Vulnerability (NS-SA-2023-0092)	Nessus	NewStart CGSL Local Security Checks	medium
184734	Rocky Linux 8 : bluez (RLSA-2022:2081)	Nessus	Rocky Linux Local Security Checks	medium
181741	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2023:3689-1)	Nessus	SuSE Local Security Checks	medium
179595	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:3240-1)	Nessus	SuSE Local Security Checks	medium
179576	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bluez (SUSE-SU-2023:3238-1)	Nessus	SuSE Local Security Checks	medium
166429	Debian DLA-3157-1 : bluez - LTS security update	Nessus	Debian Local Security Checks	critical
161132	AlmaLinux 8 : bluez (ALSA-2022:2081)	Nessus	Alma Linux Local Security Checks	medium
161013	RHEL 8 : bluez (RHSA-2022:2081)	Nessus	Red Hat Local Security Checks	medium
160947	CentOS 8 : bluez (CESA-2022:2081)	Nessus	CentOS Local Security Checks	medium
156584	Photon OS 3.0: Bluez PHSA-2021-3.0-0346	Nessus	PhotonOS Local Security Checks	medium
155712	Debian DLA-2827-1 : bluez - LTS security update	Nessus	Debian Local Security Checks	high
155687	Ubuntu 18.04 LTS / 20.04 LTS : BlueZ vulnerabilities (USN-5155-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2021-41229

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

high

critical