An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.
In BlueZ 5.42, a buffer overflow was observed in "readn" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlinkinit of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211936.
In BlueZ 5.42, a use-after-free was identified in "confopt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
In BlueZ 5.42, a buffer overflow was observed in "commandsdump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
In BlueZ 5.42, an out-of-bounds read was observed in "lemetaevdump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'evlemetastr' array) is overflowed.
In BlueZ 5.42, a buffer overflow was observed in "pklgreadhci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
In BlueZ 5.42, a buffer overflow was observed in "pincodereplydump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pincodereplycp cp" parameter.
In BlueZ 5.42, a buffer over-read was observed in "l2capdump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
In BlueZ 5.42, a buffer over-read was identified in "l2cappacket" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
In BlueZ 5.42, a buffer overflow was observed in "setextctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
A bug in bluez prevents the disabling of Bluetooth discoverability. In certain situations, this flaw could potentially lead to the unauthorized pairing of Bluetooth devices.
References: https://bugzilla.redhat.com/showbug.cgi?id=1602985
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-8805.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-8805.