Bug 1884817 (CVE-2020-27153)

Summary:	CVE-2020-27153 bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE
Product:	[Other] Security Response	Reporter:	Todd Cullum <tcullum>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bnocera, darcari, dzickus, gtiwari, hwkernel-mgr
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	bluez 5.55	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:36:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1885378
Bug Blocks:	1881960

Description Todd Cullum 2020-10-02 21:03:00 UTC

A double-free vulnerability was found in bluez-5.54's gatttool disconnect_cb() routine from /src/shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.

References:

1. https://github.com/bluez/bluez/commit/5a180f2ec9edfacafd95e5fed20d36fe8e077f07 
2. https://github.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a

Comment 1 Todd Cullum 2020-10-02 21:03:03 UTC

Acknowledgments:

Name: Jay LV (antgroup)

Comment 4 Todd Cullum 2020-10-02 21:47:08 UTC

Mitigation:

This flaw can be mitigated by only connecting the gatttool client to trusted GATT servers/devices. The flaw is in the service discovery which occurs after a Bluetoth Low Energy (BLE) connection has been established to a device. A secondary mitigation for this flaw is to disable bluetooth.  Instructions on disabling bluetooth in Red Hat Enterprise Linux are available at: https://access.redhat.com/solutions/2682931

Comment 5 Todd Cullum 2020-10-05 18:42:03 UTC

Note that in theory, a double free could lead to code execution but in this case, there is not yet a known path to actually cause this due to the small time window between the two calls to free(). For this reason, we've marked the CVSS impact to integrity and confidentiality as Low.

Comment 8 errata-xmlrpc 2021-05-18 13:34:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1598 https://access.redhat.com/errata/RHSA-2021:1598

Comment 9 Product Security DevOps Team 2021-05-18 20:36:30 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27153