CVE-2021-41229

Katalog CVE

CVSS 6.5 · Medium EPSS 1,2%

Kerentanan Uncontrolled Resource Consumption pada bluez, debian linux. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

Rincian

Terbit di NVD

12 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bluez/bluez/security/advisories/GHSA-3fqg-r8j5-f5xq exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/11/msg00022.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211203-0004/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html