CVE-2021-43400

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.

Security Fix(es):

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.(CVE-2021-43400)

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.

Security Fix(es):

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.(CVE-2021-43400)

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.(CVE-2021-0129)

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash. (CVE-2021-41229)

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

This update for bluez fixes the following issues:

• CVE-2021-0129: Fixed improper access control (bsc#1186463).
• CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle attacker to identify the Passkey (bsc#1186463).
• CVE-2019-8921: Fixed heap-based buffer overflow via crafted request (bsc#1193237).
• CVE-2019-8922: Fixed heap-based buffer overflow via crafted request (bsc#1193227).
• CVE-2021-3658: Fixed adapter incorrectly restoring discoverable state after powered down (bsc#1188859).
• CVE-2021-43400: Fixed use-after-free in gatt-database.c (bsc#1192394).

This update for bluez fixes the following issues:

• CVE-2019-8921: Fixed heap-based buffer overflow via crafted request (bsc#1193237).
• CVE-2019-8922: Fixed heap-based buffer overflow via crafted request (bsc#1193227).
• CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle attacker to identify the Passkey (bsc#1186463).
• CVE-2021-0129: Fixed improper access control (bsc#1186463).
• CVE-2021-3658: Fixed adapter incorrectly restoring discoverable state after powered down (bsc#1188859).
• CVE-2021-43400: Fixed use-after-free in gatt-database.c (bsc#1192394).

This update for bluez fixes the following issues:

• CVE-2021-43400: Fixed use-after-free in gatt-database.c (bsc#1192394).
• CVE-2021-3658: Fixed adapter incorrectly restoring discoverable state after powered down (bsc#1188859).

It was discovered that BlueZ incorrectly handled the Discoverable status when a device is powered down. This could result in devices being powered up discoverable, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. (CVE-2021-3658)

It was discovered that BlueZ incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause BlueZ to consume resources, leading to a denial of service. (CVE-2021-41229)

It was discovered that the BlueZ gatt server incorrectly handled disconnects. A remote attacker could possibly use this issue to cause BlueZ to crash, leading to a denial of service. (CVE-2021-43400)