Heap-based Buffer Overflow in BlueZ Phone Book Access Profile Affects Linux Systems
CVE-2023-50230

8HIGH

Key Information:

Vendor

Bluez

Status
Bluez
Vendor
CVE Published:
3 May 2024

What is CVE-2023-50230?

A vulnerability in the BlueZ Phone Book Access Profile allows network-adjacent attackers to execute arbitrary code by exploiting a heap-based buffer overflow. This security flaw arises from inadequate validation of user-supplied data length, leading to potential exploitation when a user connects to a malicious Bluetooth device. Attackers can execute code in the context of root privileges, making this a significant risk for affected installations of BlueZ.

Affected Version(s)

BlueZ 5.66

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1812/
x_research-advisory
https://github.com/bluez/bluez/commit/5ab5352531a9cc7058c...
vendor-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.