BlueZ up to 5.58 profiles/audio/avdtp.c denial of service

Summaryinfo

A vulnerability was found in BlueZ up to 5.58. It has been rated as problematic. Affected is an unknown function of the file profiles/audio/avdtp.c. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2022-39177. It is possible to launch the attack on the physical device. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in BlueZ up to 5.58. This issue affects an unknown function of the file profiles/audio/avdtp.c. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.

The weakness was disclosed 09/02/2022 as USN-5481-1. It is possible to read the advisory at bugs.launchpad.net. The identification of this vulnerability is CVE-2022-39177 since 09/02/2022. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 5.59 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-41722). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• BlueZ

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 5.19
• 5.20
• 5.21
• 5.22
• 5.23
• 5.24
• 5.25
• 5.26
• 5.27
• 5.28
• 5.29
• 5.30
• 5.31
• 5.32
• 5.33
• 5.34
• 5.35
• 5.36
• 5.37
• 5.38
• 5.39
• 5.40
• 5.41
• 5.42
• 5.43
• 5.44
• 5.45
• 5.46
• 5.47
• 5.48
• 5.49
• 5.50
• 5.51
• 5.52
• 5.53
• 5.54
• 5.55
• 5.56
• 5.57
• 5.58

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion