PT-2023-9090 · Bluez+8 · Bluez+8

Lucas Leong + 1 · Published 2023-04-26 · Updated 2026-03-29 · CVE-2023-50230

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlueZ (affected versions not specified)

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this issue, where the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this issue to execute code in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

DoS

Stack Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-121

CWE-122

Related Identifiers

ALSA-2024:9413

AZL-40237

BDU:2024-03556

CVE-2023-50230

DLA-3879-1

INFSA-2024_9413

OESA-2024-1019

OESA-2024-1056

OPENSUSE-SU-2024_0182-1

OPENSUSE-SU-2024_0183-1

OPENSUSE-SU-2024_0204-1

RHSA-2024:9413

RHSA-2024_9413

RLSA-2024:9413

SUSE-SU-2024:0166-1

SUSE-SU-2024:0167-1

SUSE-SU-2024:0182-1

SUSE-SU-2024:0183-1

SUSE-SU-2024:0204-1

USN-7222-1

ZDI-23-1812

Affected Products

Almalinux

Astra Linux

Bluez

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 82

• https://osv.dev/vulnerability/DLA-3879-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:9413 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1812 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-317-CVE-2023-50230 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50230 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:9413 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-50230 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03556 · Security Note
• https://osv.dev/vulnerability/USN-7222-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1056 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7222-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40237 · Vendor Advisory