A double-free vulnerability was found in bluez-5.54's gatttool disconnect_cb() routine from /src/shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event. References: 1. https://github.com/bluez/bluez/commit/5a180f2ec9edfacafd95e5fed20d36fe8e077f07 2. https://github.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a
Acknowledgments: Name: Jay LV (antgroup)
Mitigation: This flaw can be mitigated by only connecting the gatttool client to trusted GATT servers/devices. The flaw is in the service discovery which occurs after a Bluetoth Low Energy (BLE) connection has been established to a device. A secondary mitigation for this flaw is to disable bluetooth. Instructions on disabling bluetooth in Red Hat Enterprise Linux are available at: https://access.redhat.com/solutions/2682931
Note that in theory, a double free could lead to code execution but in this case, there is not yet a known path to actually cause this due to the small time window between the two calls to free(). For this reason, we've marked the CVSS impact to integrity and confidentiality as Low.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1598 https://access.redhat.com/errata/RHSA-2021:1598
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-27153