An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bluezUpgrade bluez-libs-develUpgrade bluez-libsUpgrade bluez-hid2hciUpgrade bluez-debuginfoUpgrade bluez-cups | Oct 23, 2023 | Nov 29, 2021 |
| Debian | — | Upgrade bluez | Nov 29, 2021 | Nov 29, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade bluezUpgrade bluez-libs | May 25, 2022 | Nov 29, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade bluez-libsUpgrade bluez-libs-develUpgrade bluez | Apr 26, 2022 | Nov 29, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 29, 2021 |
| Suse | — | Upgrade libbluetooth3Upgrade bluez-cupsUpgrade bluezUpgrade bluez-devel | Aug 9, 2024 | Nov 29, 2021 |
| Ubuntu | — | Upgrade bluez (Ubuntu Pro)Upgrade libbluetooth3 (Ubuntu Pro) | Nov 19, 2024 | Nov 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub