Bug 1218301 (CVE-2023-50230)

Summary:	VUL-0: CVE-2023-50230: bluez: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	gabriele.sonnu, jlee, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/388958/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-50230:7.1:(AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-12-21 09:03:11 UTC

VULNERABILITY DETAILS 	

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

ADDITIONAL DETAILS

BlueZ has issued an update to correct this vulnerability. More details can be found at:
https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443

References:
https://www.zerodayinitiative.com/advisories/ZDI-23-1812/

Comment 4 Gabriele Sonnu 2023-12-22 10:30:55 UTC

Upstream fix:

https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443 

Tracking as affected

 - SUSE:SLE-15:Update/bluez
 - SUSE:SLE-15-SP2:Update/bluez
 - SUSE:SLE-15-SP3:Update/bluez
 - SUSE:SLE-15-SP4:Update/bluez
 - SUSE:SLE-15-SP5:Update/bluez

Comment 6 Joey Lee 2024-01-16 04:40:23 UTC

(In reply to Gabriele Sonnu from comment #4)
> Upstream fix:
> 
> https://github.com/bluez/bluez/commit/
> 5ab5352531a9cc7058cce569607f3a6831464443 
> 
> Tracking as affected
> 
>  - SUSE:SLE-15:Update/bluez
>  - SUSE:SLE-15-SP2:Update/bluez
>  - SUSE:SLE-15-SP3:Update/bluez
>  - SUSE:SLE-15-SP4:Update/bluez
>  - SUSE:SLE-15-SP5:Update/bluez

I am backporting this bluez patch:

commit 5ab5352531a9cc7058cce569607f3a6831464443
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Tue Sep 19 12:14:01 2023 -0700

    pbap: Fix not checking Primary/Secundary Counter length

Comment 7 Joey Lee 2024-01-16 06:44:20 UTC

(In reply to Joey Lee from comment #6)
> (In reply to Gabriele Sonnu from comment #4)
> > Upstream fix:
> > 
> > https://github.com/bluez/bluez/commit/
> > 5ab5352531a9cc7058cce569607f3a6831464443 
> > 
> > Tracking as affected
> > 
> >  - SUSE:SLE-15:Update/bluez
> >  - SUSE:SLE-15-SP2:Update/bluez
> >  - SUSE:SLE-15-SP3:Update/bluez
> >  - SUSE:SLE-15-SP4:Update/bluez
> >  - SUSE:SLE-15-SP5:Update/bluez
> 
> I am backporting this bluez patch:
> 
> commit 5ab5352531a9cc7058cce569607f3a6831464443
> Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Date:   Tue Sep 19 12:14:01 2023 -0700
> 
>     pbap: Fix not checking Primary/Secundary Counter length

Status update:

 - SUSE:SLE-15:Update/bluez             [submitreq#317986]
 - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317985]
 - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317984]
 - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317983]
 - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317982]

Comment 8 Joey Lee 2024-01-16 06:55:46 UTC

(In reply to Joey Lee from comment #7)
> (In reply to Joey Lee from comment #6)
> > (In reply to Gabriele Sonnu from comment #4)
> > > Upstream fix:
> > > 
> > > https://github.com/bluez/bluez/commit/
> > > 5ab5352531a9cc7058cce569607f3a6831464443 
> > > 
> > > Tracking as affected
> > > 
> > >  - SUSE:SLE-15:Update/bluez
> > >  - SUSE:SLE-15-SP2:Update/bluez
> > >  - SUSE:SLE-15-SP3:Update/bluez
> > >  - SUSE:SLE-15-SP4:Update/bluez
> > >  - SUSE:SLE-15-SP5:Update/bluez
> > 
> > I am backporting this bluez patch:
> > 
> > commit 5ab5352531a9cc7058cce569607f3a6831464443
> > Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > Date:   Tue Sep 19 12:14:01 2023 -0700
> > 
> >     pbap: Fix not checking Primary/Secundary Counter length
> 
> Status update:
> 
>  - SUSE:SLE-15:Update/bluez             [submitreq#317986]
>  - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317985]
>  - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317984]
>  - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317983]
>  - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317982]

Status update:

 - SUSE:SLE-15:Update/bluez             [submitreq#317991]
 - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317987]
 - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317988]
 - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317989]
 - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317990]

Comment 10 Maintenance Automation 2024-01-19 16:30:03 UTC

SUSE-SU-2024:0167-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1192760, 1218300, 1218301
CVE References: CVE-2021-41229, CVE-2023-50229, CVE-2023-50230
Sources used:
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): bluez-5.48-150200.13.30.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): bluez-5.48-150200.13.30.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): bluez-5.48-150200.13.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Maintenance Automation 2024-01-19 16:30:05 UTC

SUSE-SU-2024:0166-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1192760, 1218300, 1218301
CVE References: CVE-2021-41229, CVE-2023-50229, CVE-2023-50230
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): bluez-5.48-150000.5.54.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): bluez-5.48-150000.5.54.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): bluez-5.48-150000.5.54.1
SUSE CaaS Platform 4.0 (src): bluez-5.48-150000.5.54.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Maintenance Automation 2024-01-23 12:30:02 UTC

SUSE-SU-2024:0183-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1218300, 1218301
CVE References: CVE-2023-50229, CVE-2023-50230
Sources used:
openSUSE Leap 15.5 (src): bluez-5.65-150500.3.6.1
SUSE Linux Enterprise Micro 5.5 (src): bluez-5.65-150500.3.6.1
Basesystem Module 15-SP5 (src): bluez-5.65-150500.3.6.1
Desktop Applications Module 15-SP5 (src): bluez-5.65-150500.3.6.1
SUSE Linux Enterprise Workstation Extension 15 SP5 (src): bluez-5.65-150500.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Maintenance Automation 2024-01-23 12:30:05 UTC

SUSE-SU-2024:0182-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1218300, 1218301
CVE References: CVE-2023-50229, CVE-2023-50230
Sources used:
openSUSE Leap 15.3 (src): bluez-5.55-150300.3.28.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): bluez-5.55-150300.3.28.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): bluez-5.55-150300.3.28.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): bluez-5.55-150300.3.28.1
SUSE Enterprise Storage 7.1 (src): bluez-5.55-150300.3.28.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Maintenance Automation 2024-01-24 16:30:30 UTC

SUSE-SU-2024:0204-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1218300, 1218301
CVE References: CVE-2023-50229, CVE-2023-50230
Sources used:
openSUSE Leap 15.4 (src): bluez-5.62-150400.4.19.1
openSUSE Leap Micro 5.3 (src): bluez-5.62-150400.4.19.1
openSUSE Leap Micro 5.4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro 5.3 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro 5.4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): bluez-5.62-150400.4.19.1
SUSE Manager Proxy 4.3 (src): bluez-5.62-150400.4.19.1
SUSE Manager Retail Branch Server 4.3 (src): bluez-5.62-150400.4.19.1
SUSE Manager Server 4.3 (src): bluez-5.62-150400.4.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Joey Lee 2024-03-05 14:39:17 UTC

(In reply to Joey Lee from comment #8)
> (In reply to Joey Lee from comment #7)
> > (In reply to Joey Lee from comment #6)
> > > (In reply to Gabriele Sonnu from comment #4)
> > > > Upstream fix:
> > > > 
> > > > https://github.com/bluez/bluez/commit/
> > > > 5ab5352531a9cc7058cce569607f3a6831464443 
> > > > 
> > > > Tracking as affected
> > > > 
> > > >  - SUSE:SLE-15:Update/bluez
> > > >  - SUSE:SLE-15-SP2:Update/bluez
> > > >  - SUSE:SLE-15-SP3:Update/bluez
> > > >  - SUSE:SLE-15-SP4:Update/bluez
> > > >  - SUSE:SLE-15-SP5:Update/bluez
> > > 
> > > I am backporting this bluez patch:
> > > 
> > > commit 5ab5352531a9cc7058cce569607f3a6831464443
> > > Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > > Date:   Tue Sep 19 12:14:01 2023 -0700
> > > 
> > >     pbap: Fix not checking Primary/Secundary Counter length
> > 
> > Status update:
> > 
> >  - SUSE:SLE-15:Update/bluez             [submitreq#317986]
> >  - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317985]
> >  - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317984]
> >  - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317983]
> >  - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317982]
> 
> Status update:
> 
>  - SUSE:SLE-15:Update/bluez             [submitreq#317991]
>  - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317987]
>  - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317988]
>  - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317989]
>  - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317990]

Status update:

 - SUSE:SLE-15:Update/bluez             [merged]
 - SUSE:SLE-15-SP2:Update/bluez         [merged]
 - SUSE:SLE-15-SP3:Update/bluez         [merged]
 - SUSE:SLE-15-SP4:Update/bluez         [merged]
 - SUSE:SLE-15-SP5:Update/bluez         [merged]

reset assigner

Comment 16 Carlos López 2024-05-30 18:56:26 UTC

Done, closing.