UBUNTU-CVE-2019-8921

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2019-8921
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-8921.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-8921
Related
Published
2021-11-29T08:15:00Z
Modified
2021-11-29T08:15:00Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVCATTRREQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function serviceattrreq of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

References

Affected packages

Ubuntu:Pro:16.04:LTS / bluez

Package

Name
bluez

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.35-0ubuntu2
5.36-0ubuntu1
5.37-0ubuntu5
5.37-0ubuntu5.1
5.37-0ubuntu5.3
5.37-0ubuntu5.3+esm1
5.37-0ubuntu5.3+esm2
5.37-0ubuntu5.3+esm3
5.37-0ubuntu5.3+esm4

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / bluez

Package

Name
bluez
Purl
pkg:deb/ubuntu/bluez@5.48-0ubuntu3.6?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.48-0ubuntu3.6

Affected versions

5.*

5.46-0ubuntu3
5.46-0ubuntu4
5.48-0ubuntu3
5.48-0ubuntu3.1
5.48-0ubuntu3.2
5.48-0ubuntu3.3
5.48-0ubuntu3.4
5.48-0ubuntu3.5

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libbluetooth3": "5.48-0ubuntu3.6",
            "bluetooth": "5.48-0ubuntu3.6",
            "bluez-hcidump": "5.48-0ubuntu3.6",
            "bluez-cups": "5.48-0ubuntu3.6",
            "bluez-tests": "5.48-0ubuntu3.6",
            "libbluetooth3-dbg": "5.48-0ubuntu3.6",
            "bluez-dbg": "5.48-0ubuntu3.6",
            "libbluetooth-dev": "5.48-0ubuntu3.6",
            "bluez": "5.48-0ubuntu3.6",
            "bluez-obexd": "5.48-0ubuntu3.6"
        }
    ]
}

Ubuntu:20.04:LTS / bluez

Package

Name
bluez
Purl
pkg:deb/ubuntu/bluez@5.53-0ubuntu3?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.53-0ubuntu3

Affected versions

5.*

5.50-0ubuntu4
5.51-0ubuntu1
5.51-0ubuntu2
5.52-0ubuntu1
5.52-0ubuntu2
5.53-0ubuntu1
5.53-0ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libbluetooth3": "5.53-0ubuntu3",
            "bluetooth": "5.53-0ubuntu3",
            "bluez-hcidump": "5.53-0ubuntu3",
            "bluez-cups": "5.53-0ubuntu3",
            "bluez-tests": "5.53-0ubuntu3",
            "libbluetooth3-dbg": "5.53-0ubuntu3",
            "bluez-dbg": "5.53-0ubuntu3",
            "libbluetooth-dev": "5.53-0ubuntu3",
            "bluez": "5.53-0ubuntu3",
            "bluez-obexd": "5.53-0ubuntu3"
        }
    ]
}