Heap-based Buffer Overflow in BlueZ Affects Bluetooth Connectivity
CVE-2023-50229

8HIGH

Key Information:

Vendor

Bluez

Status
Bluez
Vendor
CVE Published:
3 May 2024

What is CVE-2023-50229?

A vulnerability exists within BlueZ's implementation of the Phone Book Access Profile, where improper validation of user-supplied data allows an attacker to exploit a heap-based buffer overflow. By connecting to a malicious Bluetooth device, the attacker can execute arbitrary code in the context of the affected system, potentially compromising its security. Proper safeguards against untrusted data interaction are crucial to mitigate this risk.

Affected Version(s)

BlueZ 5.66

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1811/
x_research-advisory
https://github.com/bluez/bluez/commit/5ab5352531a9cc7058c...
vendor-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.