PT-2022-6907 · Bluez+3 · Bluez+3

CVE-2022-39177 · Published 2021-08-31 · Updated 2024-09-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlueZ versions prior to 5.59

Description The issue is related to insufficient input validation in the profiles/audio/avdtp.c component of the BlueZ package. This can be exploited by physically proximate attackers to cause a denial of service. The vulnerability is associated with the processing of malformed and invalid capabilities.

Recommendations For BlueZ versions prior to 5.59, update to version 5.59 or later to resolve the issue. As a temporary workaround, consider restricting access to the avdtp.c component to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2021-2665

ALT-PU-2021-3492

BDU:2023-05497

CVE-2022-39177

DLA-3157-1

DLA-3879-1

OESA-2022-1922

SUSE-SU-2023:0155-1

SUSE-SU-2023:0156-1

SUSE-SU-2023:0166-1

SUSE-SU-2023:0168-1

USN-5481-1

Affected Products

Alt Linux

Astra Linux

Bluez

Suse

References · 40

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39177.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2023:0166-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39177 · Security Note
• https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 · Patch
• https://ubuntu.com/security/CVE-2022-39177 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5481-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3157-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0168-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05497 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39177 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5481-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0156-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0155-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1922 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39177 · Security Note