Описание
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Отчет
Red Hat ships BlueZ in Red Hat Enterprise Linux and related products. This out-of-bounds read vulnerability in the AVRCP profile requires a malicious Bluetooth device within radio range and user interaction to pair with that device. Successful exploitation could crash the bluetoothd daemon (denial of service) or expose limited heap memory contents.
Меры по смягчению последствий
Disable the AVRCP Bluetooth profile if it is not needed, or restrict Bluetooth pairing to trusted devices only. On systems where Bluetooth is not required, disable the Bluetooth subsystem entirely.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | bluez | Fix deferred | ||
| Red Hat Enterprise Linux 6 | bluez | Not affected | ||
| Red Hat Enterprise Linux 7 | bluez | Fix deferred | ||
| Red Hat Enterprise Linux 8 | bluez | Fix deferred | ||
| Red Hat Enterprise Linux 9 | bluez | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
(A flaw was found in BlueZ. Insufficient validation of packet length fi ...)
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fi ...
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
EPSS
6.3 Medium
CVSS3