cnvd - cnvd-2021-95606

cnvd-2021-95606

Vulnerability from cnvd

Title: BlueZ信息泄露漏洞（CNVD-2021-95606）

Description:

BlueZ是一款使用C语言编写的蓝牙协议堆栈，它主要用于提供对核心蓝牙层和协议的支持。

Bluetoothd in BlueZ 5.48及之前版本存在安全漏洞，攻击者可以通过制作恶意CSTATE，诱使服务器返回比缓冲区实际保存的字节更多的字节，从而导致任意堆数据泄漏。

Severity: 低

Patch Name: BlueZ信息泄露漏洞（CNVD-2021-95606）的补丁

Patch Description:

BlueZ是一款使用C语言编写的蓝牙协议堆栈，它主要用于提供对核心蓝牙层和协议的支持。

Bluetoothd in BlueZ 5.48及之前版本存在安全漏洞，攻击者可以通过制作恶意CSTATE，诱使服务器返回比缓冲区实际保存的字节更多的字节，从而导致任意堆数据泄漏。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/

Reference: https://vigilance.fr/vulnerability/BlueZ-memory-reading-via-SDP-SVC-ATTR-REQ-36977

Impacted products

Name
Bluez Bluez <=5.48

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-8921"
    }
  },
  "description": "BlueZ\u662f\u4e00\u6b3e\u4f7f\u7528C\u8bed\u8a00\u7f16\u5199\u7684\u84dd\u7259\u534f\u8bae\u5806\u6808\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u63d0\u4f9b\u5bf9\u6838\u5fc3\u84dd\u7259\u5c42\u548c\u534f\u8bae\u7684\u652f\u6301\u3002\n\nBluetoothd in BlueZ 5.48\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u5236\u4f5c\u6076\u610fCSTATE\uff0c\u8bf1\u4f7f\u670d\u52a1\u5668\u8fd4\u56de\u6bd4\u7f13\u51b2\u533a\u5b9e\u9645\u4fdd\u5b58\u7684\u5b57\u8282\u66f4\u591a\u7684\u5b57\u8282\uff0c\u4ece\u800c\u5bfc\u81f4\u4efb\u610f\u5806\u6570\u636e\u6cc4\u6f0f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-95606",
  "openTime": "2021-12-09",
  "patchDescription": "BlueZ\u662f\u4e00\u6b3e\u4f7f\u7528C\u8bed\u8a00\u7f16\u5199\u7684\u84dd\u7259\u534f\u8bae\u5806\u6808\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u63d0\u4f9b\u5bf9\u6838\u5fc3\u84dd\u7259\u5c42\u548c\u534f\u8bae\u7684\u652f\u6301\u3002\r\n\r\nBluetoothd in BlueZ 5.48\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u5236\u4f5c\u6076\u610fCSTATE\uff0c\u8bf1\u4f7f\u670d\u52a1\u5668\u8fd4\u56de\u6bd4\u7f13\u51b2\u533a\u5b9e\u9645\u4fdd\u5b58\u7684\u5b57\u8282\u66f4\u591a\u7684\u5b57\u8282\uff0c\u4ece\u800c\u5bfc\u81f4\u4efb\u610f\u5806\u6570\u636e\u6cc4\u6f0f\u3002 \u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "BlueZ\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2021-95606\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Bluez Bluez \u003c=5.48"
  },
  "referenceLink": "https://vigilance.fr/vulnerability/BlueZ-memory-reading-via-SDP-SVC-ATTR-REQ-36977",
  "serverity": "\u4f4e",
  "submitTime": "2021-12-01",
  "title": "BlueZ\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2021-95606\uff09"
}

CVE-2019-8921 (GCVE-0-2019-8921)

Vulnerability from cvelistv5

Published

2021-11-29 00:00

Modified

2024-08-04 21:31

Severity ?

CWE

Summary

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

References

▼	URL	Tags
	https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/
	https://security.netapp.com/advisory/ntap-20211203-0002/
	https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T21:31:37.641Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211203-0002/"
          },
          {
            "name": "[debian-lts-announce] 20221024 [SECURITY] [DLA 3157-1] bluez security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-24T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211203-0002/"
        },
        {
          "name": "[debian-lts-announce] 20221024 [SECURITY] [DLA 3157-1] bluez security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-8921",
    "datePublished": "2021-11-29T00:00:00",
    "dateReserved": "2019-02-18T00:00:00",
    "dateUpdated": "2024-08-04T21:31:37.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted