Bug 1218300 (CVE-2023-50229) - VUL-0: CVE-2023-50229: bluez: BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability
Summary: VUL-0: CVE-2023-50229: bluez: BlueZ Phone Book Access Profile Heap-based Buff...
Status: RESOLVED FIXED
Alias: CVE-2023-50229
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/388959/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-50229:7.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-21 09:01 UTC by SMASH SMASH
Modified: 2024-05-30 18:56 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-12-21 09:01:45 UTC
VULNERABILITY DETAILS 	

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

ADDITIONAL DETAILS 	

BlueZ has issued an update to correct this vulnerability. More details can be found at:
https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443 

References:
https://www.zerodayinitiative.com/advisories/ZDI-23-1811/
Comment 2 Gabriele Sonnu 2023-12-21 10:28:59 UTC
Upstream fix:

https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443 

Tracking as affected

 - SUSE:SLE-15:Update/bluez
 - SUSE:SLE-15-SP2:Update/bluez
 - SUSE:SLE-15-SP3:Update/bluez
 - SUSE:SLE-15-SP4:Update/bluez
 - SUSE:SLE-15-SP5:Update/bluez
Comment 4 Joey Lee 2024-01-16 06:45:44 UTC
(In reply to Gabriele Sonnu from comment #2)
> Upstream fix:
> 
> https://github.com/bluez/bluez/commit/
> 5ab5352531a9cc7058cce569607f3a6831464443 
> 
> Tracking as affected
> 
>  - SUSE:SLE-15:Update/bluez
>  - SUSE:SLE-15-SP2:Update/bluez
>  - SUSE:SLE-15-SP3:Update/bluez
>  - SUSE:SLE-15-SP4:Update/bluez
>  - SUSE:SLE-15-SP5:Update/bluez

The patch is the same with bsc#1218301:

commit 5ab5352531a9cc7058cce569607f3a6831464443
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Tue Sep 19 12:14:01 2023 -0700

    pbap: Fix not checking Primary/Secundary Counter length

Status update

 - SUSE:SLE-15:Update/bluez             [submitreq#317986]
 - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317985]
 - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317984]
 - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317983]
 - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317982]
Comment 5 Joey Lee 2024-01-16 06:55:33 UTC
(In reply to Joey Lee from comment #4)
> (In reply to Gabriele Sonnu from comment #2)
> > Upstream fix:
> > 
> > https://github.com/bluez/bluez/commit/
> > 5ab5352531a9cc7058cce569607f3a6831464443 
> > 
> > Tracking as affected
> > 
> >  - SUSE:SLE-15:Update/bluez
> >  - SUSE:SLE-15-SP2:Update/bluez
> >  - SUSE:SLE-15-SP3:Update/bluez
> >  - SUSE:SLE-15-SP4:Update/bluez
> >  - SUSE:SLE-15-SP5:Update/bluez
> 
> The patch is the same with bsc#1218301:
> 
> commit 5ab5352531a9cc7058cce569607f3a6831464443
> Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Date:   Tue Sep 19 12:14:01 2023 -0700
> 
>     pbap: Fix not checking Primary/Secundary Counter length
> 
> Status update
> 
>  - SUSE:SLE-15:Update/bluez             [submitreq#317986]
>  - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317985]
>  - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317984]
>  - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317983]
>  - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317982]

Status update:

 - SUSE:SLE-15:Update/bluez             [submitreq#317991]
 - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317987]
 - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317988]
 - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317989]
 - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317990]
Comment 7 Maintenance Automation 2024-01-19 16:30:03 UTC
SUSE-SU-2024:0167-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1192760, 1218300, 1218301
CVE References: CVE-2021-41229, CVE-2023-50229, CVE-2023-50230
Sources used:
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): bluez-5.48-150200.13.30.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): bluez-5.48-150200.13.30.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): bluez-5.48-150200.13.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Maintenance Automation 2024-01-19 16:30:05 UTC
SUSE-SU-2024:0166-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1192760, 1218300, 1218301
CVE References: CVE-2021-41229, CVE-2023-50229, CVE-2023-50230
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): bluez-5.48-150000.5.54.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): bluez-5.48-150000.5.54.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): bluez-5.48-150000.5.54.1
SUSE CaaS Platform 4.0 (src): bluez-5.48-150000.5.54.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Maintenance Automation 2024-01-23 12:30:02 UTC
SUSE-SU-2024:0183-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1218300, 1218301
CVE References: CVE-2023-50229, CVE-2023-50230
Sources used:
openSUSE Leap 15.5 (src): bluez-5.65-150500.3.6.1
SUSE Linux Enterprise Micro 5.5 (src): bluez-5.65-150500.3.6.1
Basesystem Module 15-SP5 (src): bluez-5.65-150500.3.6.1
Desktop Applications Module 15-SP5 (src): bluez-5.65-150500.3.6.1
SUSE Linux Enterprise Workstation Extension 15 SP5 (src): bluez-5.65-150500.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Maintenance Automation 2024-01-23 12:30:05 UTC
SUSE-SU-2024:0182-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1218300, 1218301
CVE References: CVE-2023-50229, CVE-2023-50230
Sources used:
openSUSE Leap 15.3 (src): bluez-5.55-150300.3.28.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): bluez-5.55-150300.3.28.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): bluez-5.55-150300.3.28.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): bluez-5.55-150300.3.28.1
SUSE Enterprise Storage 7.1 (src): bluez-5.55-150300.3.28.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2024-01-24 16:30:30 UTC
SUSE-SU-2024:0204-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1218300, 1218301
CVE References: CVE-2023-50229, CVE-2023-50230
Sources used:
openSUSE Leap 15.4 (src): bluez-5.62-150400.4.19.1
openSUSE Leap Micro 5.3 (src): bluez-5.62-150400.4.19.1
openSUSE Leap Micro 5.4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro 5.3 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Micro 5.4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): bluez-5.62-150400.4.19.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): bluez-5.62-150400.4.19.1
SUSE Manager Proxy 4.3 (src): bluez-5.62-150400.4.19.1
SUSE Manager Retail Branch Server 4.3 (src): bluez-5.62-150400.4.19.1
SUSE Manager Server 4.3 (src): bluez-5.62-150400.4.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Joey Lee 2024-03-05 14:33:24 UTC
(In reply to Joey Lee from comment #5)
> (In reply to Joey Lee from comment #4)
> > (In reply to Gabriele Sonnu from comment #2)
> > > Upstream fix:
> > > 
> > > https://github.com/bluez/bluez/commit/
> > > 5ab5352531a9cc7058cce569607f3a6831464443 
> > > 
> > > Tracking as affected
> > > 
> > >  - SUSE:SLE-15:Update/bluez
> > >  - SUSE:SLE-15-SP2:Update/bluez
> > >  - SUSE:SLE-15-SP3:Update/bluez
> > >  - SUSE:SLE-15-SP4:Update/bluez
> > >  - SUSE:SLE-15-SP5:Update/bluez
> > 
> > The patch is the same with bsc#1218301:
> > 
> > commit 5ab5352531a9cc7058cce569607f3a6831464443
> > Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > Date:   Tue Sep 19 12:14:01 2023 -0700
> > 
> >     pbap: Fix not checking Primary/Secundary Counter length
> > 
> > Status update
> > 
> >  - SUSE:SLE-15:Update/bluez             [submitreq#317986]
> >  - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317985]
> >  - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317984]
> >  - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317983]
> >  - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317982]
> 
> Status update:
> 
>  - SUSE:SLE-15:Update/bluez             [submitreq#317991]
>  - SUSE:SLE-15-SP2:Update/bluez         [submitreq#317987]
>  - SUSE:SLE-15-SP3:Update/bluez         [submitreq#317988]
>  - SUSE:SLE-15-SP4:Update/bluez         [submitreq#317989]
>  - SUSE:SLE-15-SP5:Update/bluez         [submitreq#317990]

Status update:

 - SUSE:SLE-15:Update/bluez             [merged]
 - SUSE:SLE-15-SP2:Update/bluez         [merged]
 - SUSE:SLE-15-SP3:Update/bluez         [merged]
 - SUSE:SLE-15-SP4:Update/bluez         [merged]
 - SUSE:SLE-15-SP5:Update/bluez         [merged]

reset assigner
Comment 13 Carlos López 2024-05-30 18:56:25 UTC
Done, closing.