{"id":"CVE-2021-3588","aliases":["AZL-7183","DEBIAN-CVE-2021-3588","EUVD-2021-26896","GHSA-3h8m-q4x3-3fhw","MGASA-2021-0281","OESA-2021-1254","SUSE-SU-2021:2459-1","UBUNTU-CVE-2021-3588","USN-4989-1","openSUSE-SU-2021:2459-1","openSUSE-SU-2024:12446-1"],"status":"published","title":"memory contents disclosure in cli_feat_read_cb","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0045,"percentile":0.39439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-788"],"published":"2021-06-10T02:30:11Z","modified":"2026-10-23T18:03:29Z","fixes":[{"ecosystem":"Azure Linux:2","package":"bluez","fixed_in":["5.63-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bluez","fixed_in":["5.55-3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bluez","fixed_in":["5.55-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.55-3.1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"bluez","fixed_in":["5.54-3.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"bluez","fixed_in":["5.55-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"bluez","fixed_in":["5.55-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"bluez","fixed_in":["5.55-3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"bluez","fixed_in":["5.55-3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.63-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-1.2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-3.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.2"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.5"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.2"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.65-4.1"}]}],"bundled":4}],"products":[{"vendor":"bluez","product":"bluez"}],"references":[{"url":"https://github.com/bluez/bluez/issues/70","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202209-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3588","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3h8m-q4x3-3fhw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3588","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29140","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4989-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1254","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212459-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187165","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3588","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-3588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-27153","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FD7KE3RMFCUKN7TQCYXDCNJGFVIORKJL/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0129","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3588","title":"memory contents disclosure in cli_feat_read_cb","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T02:30:11.654Z","modified":"2024-09-16T23:37:02.79Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-788","CWE-125"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26896","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T02:30:11Z","modified":"2024-09-16T23:37:02Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:54:48.722382Z"}],"ghsa":[{"id":"GHSA-3h8m-q4x3-3fhw","title":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the ...","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2022-05-24T19:04:57Z","modified":"2023-01-28T05:07:54Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:44:35.015986Z"}],"nvd":[{"id":"CVE-2021-3588","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T03:15:07.477Z","modified":"2026-06-17T04:05:23.61Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-125","CWE-788"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"AZL-7183","title":"CVE-2021-3588 affecting package bluez for versions less than 5.63-1","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T03:15:07Z","modified":"2026-04-21T04:36:39.399197Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2021-3588","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T03:15:07.477Z","modified":"2026-10-20T10:54:46.822832109Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3588","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T03:15:07.477Z","modified":"2026-10-23T18:03:29.347455743Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1254","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\r\n\r\nThe cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the \u0026apos;offset\u0026apos; variable before using it as an index into an array for reading.(CVE-2021-3588)","status":"published","published":"2021-07-03T11:04:29Z","modified":"2026-08-18T01:15:46.024528987Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-3588","description":"The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.","status":"published","published":"2021-06-10T03:15:00Z","modified":"2026-04-22T12:56:58.488997Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"MGASA-2021-0281","title":"Updated bluez packages fix security vulnerability","description":"Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 \nthrough 5.2 may permit a nearby man-in-the-middle attacker to identify the \nPasskey used during pairing (in the Passkey authentication procedure) by \nreflection of the public key and the authentication evidence of the initiating\ndevice, potentially permitting this attacker to complete authenticated pairing\nwith the responding device using the correct Passkey for the pairing session.\nThe attack methodology determines the Passkey value one bit at a time \n(CVE-2020-26558).\n\nThe cli_feat_read_cb() function in src/gatt-database.c does not perform bounds\nchecks on the 'offset' variable before using it as an index into an array for\nreading (CVE-2021-3588).\n","status":"published","published":"2021-06-23T17:11:28Z","modified":"2026-04-16T04:44:08.242778892Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:2459-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2021-3588: Fixed a missing bounds checks inside cli_feat_read_cb() function in src/gatt-database.c (bsc#1187165)\n","status":"published","published":"2021-07-22T16:09:43Z","modified":"2026-02-04T02:44:12.763537Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:12446-1","title":"bluez-5.65-4.1 on GA media","description":"These are all security issues fixed in the bluez-5.65-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:44.547008Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2021:2459-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2021-3588: Fixed a missing bounds checks inside cli_feat_read_cb() function in src/gatt-database.c (bsc#1187165)\n","status":"published","published":"2021-07-22T16:09:42Z","modified":"2026-02-04T02:58:46.008359Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-4989-1","title":"bluez vulnerabilities","description":"It was discovered that BlueZ incorrectly checked certain permissions when\npairing. A local attacker could possibly use this issue to impersonate\ndevices. (CVE-2020-26558)\n\nJay LV discovered that BlueZ incorrectly handled redundant disconnect MGMT\nevents. A local attacker could use this issue to cause BlueZ to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-27153)\n\nZiming Zhang discovered that BlueZ incorrectly handled certain array\nindexes. A local attacker could use this issue to cause BlueZ to crash,\nresulting in a denial of service, or possibly obtain sensitive information.\nThis issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-3588)\n","status":"published","published":"2021-06-16T12:18:32Z","modified":"2026-06-03T14:04:09.316134897Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}