PT-2021-4915 · Bluez+5 · Bluez+5

Zxtwonder · Published 2021-06-09 · Updated 2024-06-15 · CVE-2021-3588

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlueZ (affected versions not specified)

Description The issue is related to the cli feat read cb() function in the src/gatt-database.c file of the Bluetooth protocol stack for Linux. It does not perform bounds checks on the offset variable before using it as an index into an array for reading. This can lead to a buffer overflow, allowing an attacker to disclose protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Access of Memory Location After End of Buffer

Out of bounds Read

Weakness Enumeration

CWE-788

CWE-125

Related Identifiers

ALT-PU-2021-1984

AZL-7183

BDU:2021-05651

CVE-2021-3588

MGASA-2021-0281

OESA-2021-1254

OPENSUSE-SU-2021:2459-1

OPENSUSE-SU-2021_2459-1

OPENSUSE-SU-2024:12446-1

SUSE-SU-2021:2459-1

SUSE-SU-2021_2459-1

USN-4989-1

Affected Products

Alt Linux

Astra Linux

Bluez

Linuxmint

Suse

Ubuntu

References · 37

• 🔥 https://github.com/bluez/bluez/issues/70 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-3588 · Vendor Advisory
• https://security.gentoo.org/glsa/202209-16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3588 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4989-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3588 · Security Note
• https://ubuntu.com/security/CVE-2020-26558 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27153 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12446-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3588 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05651 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-3588 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2459-1 · Vendor Advisory