Bugzilla – Bug 1218300
VUL-0: CVE-2023-50229: bluez: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability
Last modified: 2024-05-30 18:56:25 UTC
VULNERABILITY DETAILS This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. ADDITIONAL DETAILS BlueZ has issued an update to correct this vulnerability. More details can be found at: https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443 References: https://www.zerodayinitiative.com/advisories/ZDI-23-1811/
Upstream fix: https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443 Tracking as affected - SUSE:SLE-15:Update/bluez - SUSE:SLE-15-SP2:Update/bluez - SUSE:SLE-15-SP3:Update/bluez - SUSE:SLE-15-SP4:Update/bluez - SUSE:SLE-15-SP5:Update/bluez
(In reply to Gabriele Sonnu from comment #2) > Upstream fix: > > https://github.com/bluez/bluez/commit/ > 5ab5352531a9cc7058cce569607f3a6831464443 > > Tracking as affected > > - SUSE:SLE-15:Update/bluez > - SUSE:SLE-15-SP2:Update/bluez > - SUSE:SLE-15-SP3:Update/bluez > - SUSE:SLE-15-SP4:Update/bluez > - SUSE:SLE-15-SP5:Update/bluez The patch is the same with bsc#1218301: commit 5ab5352531a9cc7058cce569607f3a6831464443 Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Date: Tue Sep 19 12:14:01 2023 -0700 pbap: Fix not checking Primary/Secundary Counter length Status update - SUSE:SLE-15:Update/bluez [submitreq#317986] - SUSE:SLE-15-SP2:Update/bluez [submitreq#317985] - SUSE:SLE-15-SP3:Update/bluez [submitreq#317984] - SUSE:SLE-15-SP4:Update/bluez [submitreq#317983] - SUSE:SLE-15-SP5:Update/bluez [submitreq#317982]
(In reply to Joey Lee from comment #4) > (In reply to Gabriele Sonnu from comment #2) > > Upstream fix: > > > > https://github.com/bluez/bluez/commit/ > > 5ab5352531a9cc7058cce569607f3a6831464443 > > > > Tracking as affected > > > > - SUSE:SLE-15:Update/bluez > > - SUSE:SLE-15-SP2:Update/bluez > > - SUSE:SLE-15-SP3:Update/bluez > > - SUSE:SLE-15-SP4:Update/bluez > > - SUSE:SLE-15-SP5:Update/bluez > > The patch is the same with bsc#1218301: > > commit 5ab5352531a9cc7058cce569607f3a6831464443 > Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > Date: Tue Sep 19 12:14:01 2023 -0700 > > pbap: Fix not checking Primary/Secundary Counter length > > Status update > > - SUSE:SLE-15:Update/bluez [submitreq#317986] > - SUSE:SLE-15-SP2:Update/bluez [submitreq#317985] > - SUSE:SLE-15-SP3:Update/bluez [submitreq#317984] > - SUSE:SLE-15-SP4:Update/bluez [submitreq#317983] > - SUSE:SLE-15-SP5:Update/bluez [submitreq#317982] Status update: - SUSE:SLE-15:Update/bluez [submitreq#317991] - SUSE:SLE-15-SP2:Update/bluez [submitreq#317987] - SUSE:SLE-15-SP3:Update/bluez [submitreq#317988] - SUSE:SLE-15-SP4:Update/bluez [submitreq#317989] - SUSE:SLE-15-SP5:Update/bluez [submitreq#317990]
SUSE-SU-2024:0167-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1192760, 1218300, 1218301 CVE References: CVE-2021-41229, CVE-2023-50229, CVE-2023-50230 Sources used: SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): bluez-5.48-150200.13.30.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): bluez-5.48-150200.13.30.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): bluez-5.48-150200.13.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0166-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1192760, 1218300, 1218301 CVE References: CVE-2021-41229, CVE-2023-50229, CVE-2023-50230 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): bluez-5.48-150000.5.54.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): bluez-5.48-150000.5.54.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): bluez-5.48-150000.5.54.1 SUSE CaaS Platform 4.0 (src): bluez-5.48-150000.5.54.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0183-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1218300, 1218301 CVE References: CVE-2023-50229, CVE-2023-50230 Sources used: openSUSE Leap 15.5 (src): bluez-5.65-150500.3.6.1 SUSE Linux Enterprise Micro 5.5 (src): bluez-5.65-150500.3.6.1 Basesystem Module 15-SP5 (src): bluez-5.65-150500.3.6.1 Desktop Applications Module 15-SP5 (src): bluez-5.65-150500.3.6.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): bluez-5.65-150500.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0182-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1218300, 1218301 CVE References: CVE-2023-50229, CVE-2023-50230 Sources used: openSUSE Leap 15.3 (src): bluez-5.55-150300.3.28.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): bluez-5.55-150300.3.28.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): bluez-5.55-150300.3.28.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): bluez-5.55-150300.3.28.1 SUSE Enterprise Storage 7.1 (src): bluez-5.55-150300.3.28.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0204-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1218300, 1218301 CVE References: CVE-2023-50229, CVE-2023-50230 Sources used: openSUSE Leap 15.4 (src): bluez-5.62-150400.4.19.1 openSUSE Leap Micro 5.3 (src): bluez-5.62-150400.4.19.1 openSUSE Leap Micro 5.4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Micro 5.3 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Micro 5.4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): bluez-5.62-150400.4.19.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): bluez-5.62-150400.4.19.1 SUSE Manager Proxy 4.3 (src): bluez-5.62-150400.4.19.1 SUSE Manager Retail Branch Server 4.3 (src): bluez-5.62-150400.4.19.1 SUSE Manager Server 4.3 (src): bluez-5.62-150400.4.19.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
(In reply to Joey Lee from comment #5) > (In reply to Joey Lee from comment #4) > > (In reply to Gabriele Sonnu from comment #2) > > > Upstream fix: > > > > > > https://github.com/bluez/bluez/commit/ > > > 5ab5352531a9cc7058cce569607f3a6831464443 > > > > > > Tracking as affected > > > > > > - SUSE:SLE-15:Update/bluez > > > - SUSE:SLE-15-SP2:Update/bluez > > > - SUSE:SLE-15-SP3:Update/bluez > > > - SUSE:SLE-15-SP4:Update/bluez > > > - SUSE:SLE-15-SP5:Update/bluez > > > > The patch is the same with bsc#1218301: > > > > commit 5ab5352531a9cc7058cce569607f3a6831464443 > > Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > > Date: Tue Sep 19 12:14:01 2023 -0700 > > > > pbap: Fix not checking Primary/Secundary Counter length > > > > Status update > > > > - SUSE:SLE-15:Update/bluez [submitreq#317986] > > - SUSE:SLE-15-SP2:Update/bluez [submitreq#317985] > > - SUSE:SLE-15-SP3:Update/bluez [submitreq#317984] > > - SUSE:SLE-15-SP4:Update/bluez [submitreq#317983] > > - SUSE:SLE-15-SP5:Update/bluez [submitreq#317982] > > Status update: > > - SUSE:SLE-15:Update/bluez [submitreq#317991] > - SUSE:SLE-15-SP2:Update/bluez [submitreq#317987] > - SUSE:SLE-15-SP3:Update/bluez [submitreq#317988] > - SUSE:SLE-15-SP4:Update/bluez [submitreq#317989] > - SUSE:SLE-15-SP5:Update/bluez [submitreq#317990] Status update: - SUSE:SLE-15:Update/bluez [merged] - SUSE:SLE-15-SP2:Update/bluez [merged] - SUSE:SLE-15-SP3:Update/bluez [merged] - SUSE:SLE-15-SP4:Update/bluez [merged] - SUSE:SLE-15-SP5:Update/bluez [merged] reset assigner
Done, closing.