CVE-2019-8921

Katalog CVE

CVSS 6.5 · Medium EPSS 1,0%

Kerentanan Insufficient Verification of Data Authenticity pada bluez, debian linux. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

Rincian

Terbit di NVD

29 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/ exploit · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211203-0002/ advisory pihak ketiga