Bugzilla – Bug 1015173
VUL-1: CVE-2016-9918: bluez,bluez-hcidump: Out of bounds stack read in packet_hexdump()
Last modified: 2021-05-05 15:00:00 UTC
https://www.spinics.net/lists/linux-bluetooth/msg68898.html A out-of-bound read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash. To replicate this issue use the attached sample below and execute the following command: ./monitor/btmon -r <PoC File> PoC.file base64 encoded: AACACQQHGAAaERDoAwAAAAkjBxgAAwMDAwMDAwMDAwMDAwMDAwMDAw==
Created attachment 706109 [details] CVE-2016-9918.poc QA REPRODUCER: btmon -r CVE-2016-9918.poc should not result in a segmentation fault.
as the buffer is overwritten with characters 0-9a-f exploitability is only a crash
bugbot adjusting priority
sr:182513
*** Bug 1013893 has been marked as a duplicate of this bug. ***
SUSE-SU-2019:0510-1: An update that fixes 6 vulnerabilities is now available. Category: security (moderate) Bug References: 1013721,1013732,1013877,1015173,1026652,1057342 CVE References: CVE-2016-7837,CVE-2016-9800,CVE-2016-9801,CVE-2016-9804,CVE-2016-9918,CVE-2017-1000250 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): bluez-5.13-3.10.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): bluez-5.13-3.10.1 SUSE Linux Enterprise Server 12-LTSS (src): bluez-5.13-3.10.1
Has this been fixed on SLE-12SP4? Is there a schedule？
the update is in queue, will be released in the next days / 2 weeks
SUSE-SU-2019:0841-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1015173 CVE References: CVE-2016-9918 Sources used: SUSE Linux Enterprise Workstation Extension 15 (src): bluez-5.48-5.13.10 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): bluez-5.48-5.13.10 SUSE Linux Enterprise Module for Desktop Applications 15 (src): bluez-5.48-5.13.10 SUSE Linux Enterprise Module for Basesystem 15 (src): bluez-5.48-5.13.10 *** NOTE: This information is not intended to be used for external communication, because this may only be a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1339-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1013708,1013712,1013893,1015171,1015173 CVE References: CVE-2016-9797,CVE-2016-9798,CVE-2016-9802,CVE-2016-9917,CVE-2016-9918 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP4 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Workstation Extension 12-SP3 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Server 12-SP4 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Server 12-SP3 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Desktop 12-SP4 (src): bluez-5.13-5.12.1 SUSE Linux Enterprise Desktop 12-SP3 (src): bluez-5.13-5.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.