CVE-2023-50229

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.

Security Fix(es):

VUL-0: CVE-2023-50229: bluez: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability(CVE-2023-50229)

Root has patched CVE-2023-50229 in the bluez package for Root:Alpine:3.18. Multiple fixed versions available.

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

• bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)
• BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)
• bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)
• bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)
• bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)
• bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)
• bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)
• bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)
• bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)
• bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.

• CVE-2023-50229: fix heap-based buffer overflow vulnerability in handling Phone Book Access profile by adding proper validation of user-supplied data length before copying to buffer
• CVE-2023-50230: fix heap-based buffer overflow vulnerability in Phone Book Access profile to prevent arbitrary code execution by validating user-supplied data length before copying to buffer

• CVE-2023-27349: fix crash while handling unsupported events in avrcp
• CVE-2023-44431: fix Stack-based buffer overflow and remote code execution vulnerability
• CVE-2023-45866: restrict HID connections to avoid unauthorized input injection
• CVE-2023-50229: fix heap-based buffer overflow vulnerability in handling Phone Book Access profile by adding proper validation of user-supplied data length before copying to buffer
• CVE-2023-50230: fix heap-based buffer overflow vulnerability in Phone Book Access profile to prevent arbitrary code execution by validating user-supplied data length before copying to buffer
• CVE-2023-51580: validate AVRCP attribute list data to prevent out-of-bounds reads and information disclosure
• CVE-2023-51589: validate AVRCP media element data to prevent out-of-bounds reads and information disclosure
• CVE-2023-51592: validate AVRCP media folder data to prevent out-of-bounds reads and information disclosure
• CVE-2023-51594: validate OBEX protocol parameters to prevent out-of-bounds reads and information disclosure
• CVE-2023-51596: validate PBAP data length to prevent heap overflow and remote code execution

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

• bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

• BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

• bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)

• bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)

• bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)

• bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

• bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)

• bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)

• bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)

• bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

This update for bluez fixes the following issues:

• CVE-2021-41229: Fix leaking buffers stored in cstates cache (bsc#1192760).
• CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300).
• CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for bluez fixes the following issues:

• CVE-2021-41229: Fix leaking buffers stored in cstates cache (bsc#1192760).
• CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300).
• CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for bluez fixes the following issues:

• CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300).
• CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for bluez fixes the following issues:

• CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300).
• CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for bluez fixes the following issues:

• CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300).
• CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

Lucas Leong discovered that BlueZ incorrectly handled the Phone Book Access profile. If a user were tricked into connecting to a malicious Bluetooth device, a remote attacker could possibly use this issue to execute arbitrary code.