BlueZ vulnerabilities

An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool (part of BlueZ) when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys exceeding actual packet data, causing btmon to read beyond the allocated buffer and crash.

Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.

In BlueZ 5.42, an out-of-bounds read was identified in the 'packet_hexdump' function in the 'monitor/packet.c' source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

In BlueZ 5.42, a buffer overflow was observed in the 'read_n' function in the 'tools/hcidump.c' source file. This issue can be triggered by processing a corrupted dump file, resulting in hcidump crash.

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system.

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

An off-by-one error in the SBC frame decoder of the sbc library (BlueZ SBC codec) allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. An adjacent Bluetooth attacker can read a single byte of adjacent heap memory.