CVE-2023-27349

EUVD-2023-31125

03.05.2024, 02:15

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8 HIGH	ADJACENT_NETWORK	LOW	NONE	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 86%

Affected Products (NVD)

Vendor	Product	Version
bluez	bluez	5.66

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

bluez

bookworm	5.66-1+deb12u2 fixed
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	5.55-3.1+deb11u2 fixed
sid	5.79-1 fixed
trixie	5.79-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

bluez

bionic	Fixed 5.48-0ubuntu3.9+esm2 released
focal	Fixed 5.53-0ubuntu3.8 released
jammy	Fixed 5.64-0ubuntu1.3 released
mantic	not-affected
noble	not-affected
xenial	Fixed 5.37-0ubuntu5.3+esm4 released

openSUSE / SLES Releases

openSUSE Product

Release

bluez

suse enterprise desktop 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise desktop 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise desktop 15 SP6	5.71-150600.1.3 fixed
suse enterprise desktop 15 SP7	5.78-150700.1.3 fixed
suse enterprise sap 12 SP5	5.13-5.39.1 fixed
suse enterprise sap 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise sap 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise sap 15 SP6	5.71-150600.1.3 fixed
suse enterprise sap 15 SP7	5.78-150700.1.3 fixed
suse enterprise server 12 SP2	5.13-5.39.1 fixed
suse enterprise server 12 SP3	5.13-5.39.1 fixed
suse enterprise server 12 SP4	5.13-5.39.1 fixed
suse enterprise server 12 SP5	5.13-5.39.1 fixed
suse enterprise server 15 SP1	5.48-150000.5.49.1 fixed
suse enterprise server 15 SP2	5.48-150200.13.25.1 fixed
suse enterprise server 15 SP3	5.55-150300.3.22.1 fixed
suse enterprise server 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise server 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise server 15 SP6	5.71-150600.1.3 fixed
suse enterprise server 15 SP7	5.78-150700.1.3 fixed

bluez-deprecated

suse enterprise desktop 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise desktop 15 SP6	5.71-150600.1.3 fixed
suse enterprise desktop 15 SP7	5.78-150700.1.3 fixed
suse enterprise sap 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise sap 15 SP6	5.71-150600.1.3 fixed
suse enterprise sap 15 SP7	5.78-150700.1.3 fixed
suse enterprise server 15 SP3	5.55-150300.3.22.1 fixed
suse enterprise server 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise server 15 SP6	5.71-150600.1.3 fixed
suse enterprise server 15 SP7	5.78-150700.1.3 fixed

bluez-devel

suse enterprise server 15 SP1	5.48-150000.5.49.1 fixed
suse enterprise server 15 SP2	5.48-150200.13.25.1 fixed
suse enterprise server 15 SP3	5.55-150300.3.22.1 fixed
suse enterprise server 15 SP4	5.62-150400.4.13.1 fixed

bluez-zsh-completion

suse enterprise desktop 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise desktop 15 SP6	5.71-150600.1.3 fixed
suse enterprise desktop 15 SP7	5.78-150700.1.3 fixed
suse enterprise sap 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise sap 15 SP6	5.71-150600.1.3 fixed
suse enterprise sap 15 SP7	5.78-150700.1.3 fixed
suse enterprise server 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise server 15 SP6	5.71-150600.1.3 fixed
suse enterprise server 15 SP7	5.78-150700.1.3 fixed

libbluetooth3

suse enterprise desktop 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise desktop 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise desktop 15 SP6	5.71-150600.1.3 fixed
suse enterprise desktop 15 SP7	5.78-150700.1.3 fixed
suse enterprise sap 12 SP5	5.13-5.39.1 fixed
suse enterprise sap 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise sap 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise sap 15 SP6	5.71-150600.1.3 fixed
suse enterprise sap 15 SP7	5.78-150700.1.3 fixed
suse enterprise server 12 SP2	5.13-5.39.1 fixed
suse enterprise server 12 SP3	5.13-5.39.1 fixed
suse enterprise server 12 SP4	5.13-5.39.1 fixed
suse enterprise server 12 SP5	5.13-5.39.1 fixed
suse enterprise server 15 SP1	5.48-150000.5.49.1 fixed
suse enterprise server 15 SP2	5.48-150200.13.25.1 fixed
suse enterprise server 15 SP3	5.55-150300.3.22.1 fixed
suse enterprise server 15 SP4	5.62-150400.4.13.1 fixed
suse enterprise server 15 SP5	5.65-150500.3.3.1 fixed
suse enterprise server 15 SP6	5.71-150600.1.3 fixed
suse enterprise server 15 SP7	5.78-150700.1.3 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

bluez

RHEL 8	0:5.63-5.el8_10 fixed
RHEL 9	0:5.72-2.el9 fixed

bluez-cups

RHEL 8	0:5.63-5.el8_10 fixed
RHEL 9	0:5.72-2.el9 fixed

bluez-hid2hci

RHEL 8

0:5.63-5.el8_10

fixed

bluez-libs

RHEL 8	0:5.63-5.el8_10 fixed
RHEL 9	0:5.72-2.el9 fixed

bluez-libs-devel

RHEL 8	0:5.63-5.el8_10 fixed
RHEL 9	0:5.72-2.el9 fixed

bluez-obexd

RHEL 8	0:5.63-5.el8_10 fixed
RHEL 9	0:5.72-2.el9 fixed

Common Weakness Enumeration

CWE-129 - Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References

https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9

https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html

https://www.zerodayinitiative.com/advisories/ZDI-23-386/

https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9

https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html

https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html

https://www.zerodayinitiative.com/advisories/ZDI-23-386/