Bug 2039807 (CVE-2022-0204) - CVE-2022-0204 bluez: heap-based buffer overflow in the implementation of the gatt protocol
Summary: CVE-2022-0204 bluez: heap-based buffer overflow in the implementation of the ...
Alias: CVE-2022-0204
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 2039808
Blocks: 2027823 2039809
TreeView+ depends on / blocked
Reported: 2022-01-12 13:40 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-07-11 11:34 UTC (History)
11 users (show)

Fixed In Version: bluez 5.63
Doc Type: If docs needed, set a value
Doc Text:
A heap overflow vulnerability was found in bluez. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.
Clone Of:
Last Closed: 2022-01-12 16:00:55 UTC

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2022-01-12 13:40:19 UTC
A heap-based buffer overflow was found in BlueZ in the implementation of the gatt protocol due to an integer overflow.

Upstream commit:




Comment 1 Guilherme de Almeida Suckevicz 2022-01-12 13:40:37 UTC
Created bluez tracking bugs for this issue:

Affects: fedora-all [bug 2039808]

Comment 3 juneau 2022-01-12 15:06:24 UTC
Marking services not affected for Bluetooth vulnerability.

Comment 4 Product Security DevOps Team 2022-01-12 16:00:52 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 5 John Helmert III 2022-03-19 05:10:12 UTC
The Github advisory referenced by the CVE (https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q) seems to claim this vulnerability can result in remote code execution, but the CVE says the impact is only denial of service. Why the discrepancy?

Also, for the benefit of downstreams, can a reference to the patch be added to the CVE?

Note You need to log in before you can comment on or make changes to this bug.