PT-2023-9092 · Bluez+5 · Bluez+5

Lucas Leong + 1 · Published 2023-04-13 · Updated 2026-01-07 · CVE-2023-51596

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlueZ (affected versions not specified)

Description The issue is related to a heap-based buffer overflow in the Phone Book Access profile of BlueZ, allowing network-adjacent attackers to execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, where the target must connect to a malicious Bluetooth device. The flaw exists due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer, enabling an attacker to execute code in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Stack Overflow

Weakness Enumeration

CWE-122

CWE-121

Related Identifiers

ALSA-2024:9413

BDU:2024-03543

BDU:2024-03559

CVE-2023-51596

INFSA-2024_9413

MGASA-2025-0115

RHSA-2024:9413

RHSA-2024_9413

RLSA-2024:9413

ZDI-23-1902

Affected Products

Almalinux

Bluez

Debian

Red Hat

Red Os

Rocky Linux

References · 60

• https://errata.almalinux.org/9/ALSA-2024-9413.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-51596 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51596 · Security Note
• https://osv.dev/vulnerability/ALSA-2024:9413 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1902 · Security Note
• https://advisories.mageia.org/MGASA-2025-0115.html · Security Note
• https://bdu.fstec.ru/vul/2024-03559 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-51596 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-51596 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:9413 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03543 · Security Note
• https://osv.dev/vulnerability/CVE-2023-51596 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2023-51596 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-51596 · Vendor Advisory