Bug 2039807 (CVE-2022-0204)

Summary:	CVE-2022-0204 bluez: heap-based buffer overflow in the implementation of the gatt protocol
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ajak, bdettelb, bnocera, darcari, dwmw2, dzickus, gtiwari, hwkernel-mgr, jburrell, pbrobinson, spacewar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	bluez 5.63	Doc Type:	If docs needed, set a value
Doc Text:	A heap overflow vulnerability was found in bluez. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-01-12 16:00:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2039808
Bug Blocks:	2027823, 2039809

Description Guilherme de Almeida Suckevicz 2022-01-12 13:40:19 UTC

A heap-based buffer overflow was found in BlueZ in the implementation of the gatt protocol due to an integer overflow.

Upstream commit:

https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0

Reference:

https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q

Comment 1 Guilherme de Almeida Suckevicz 2022-01-12 13:40:37 UTC

Created bluez tracking bugs for this issue:

Affects: fedora-all [bug 2039808]

Comment 3 juneau 2022-01-12 15:06:24 UTC

Marking services not affected for Bluetooth vulnerability.

Comment 4 Product Security DevOps Team 2022-01-12 16:00:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0204

Comment 5 John Helmert III 2022-03-19 05:10:12 UTC

The Github advisory referenced by the CVE (https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q) seems to claim this vulnerability can result in remote code execution, but the CVE says the impact is only denial of service. Why the discrepancy?

Also, for the benefit of downstreams, can a reference to the patch be added to the CVE?