Bug 1884817 (CVE-2020-27153) - CVE-2020-27153 bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE
Summary: CVE-2020-27153 bluez: double free in gatttool client disconnect callback hand...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-27153
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat1885378
Blocks: Embargoed1881960
TreeView+ depends on / blocked
 
Reported: 2020-10-02 21:03 UTC by Todd Cullum
Modified: 2021-05-18 20:36 UTC (History)
5 users (show)

Fixed In Version: bluez 5.55
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-18 20:36:30 UTC

Attachments (Terms of Use)

Description Todd Cullum 2020-10-02 21:03:00 UTC 
A double-free vulnerability was found in bluez-5.54's gatttool disconnect_cb() routine from /src/shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.

References:

1. https://github.com/bluez/bluez/commit/5a180f2ec9edfacafd95e5fed20d36fe8e077f07 
2. https://github.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a
Comment 1 Todd Cullum 2020-10-02 21:03:03 UTC 
Acknowledgments:

Name: Jay LV (antgroup)
Comment 4 Todd Cullum 2020-10-02 21:47:08 UTC 
Mitigation:

This flaw can be mitigated by only connecting the gatttool client to trusted GATT servers/devices. The flaw is in the service discovery which occurs after a Bluetoth Low Energy (BLE) connection has been established to a device. A secondary mitigation for this flaw is to disable bluetooth.  Instructions on disabling bluetooth in Red Hat Enterprise Linux are available at: https://access.redhat.com/solutions/2682931
Comment 5 Todd Cullum 2020-10-05 18:42:03 UTC 
Note that in theory, a double free could lead to code execution but in this case, there is not yet a known path to actually cause this due to the small time window between the two calls to free(). For this reason, we've marked the CVSS impact to integrity and confidentiality as Low.
Comment 8 errata-xmlrpc 2021-05-18 13:34:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1598 https://access.redhat.com/errata/RHSA-2021:1598
Comment 9 Product Security DevOps Team 2021-05-18 20:36:30 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27153
Note You need to log in before you can comment on or make changes to this bug.