Login Request a demo
High severity · published May 3, 2024
CVE-2023-27349
BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability
8.0
CVSS
1.4%
EPSS
No
On KEV
Description
BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Bluez · Bluez
5.66 · source: NVD
Affected product
BL
Bluez
Bluez
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27349
Patch
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-386/
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html
More from Bluez
9.1
CVE-2021-43400
An issue was discovered in gatt-database.c in BlueZ 5.61
8.8
CVE-2024-8805
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability
8.8
CVE-2022-39177
BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c
8.8
CVE-2022-39176
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len
8.8
CVE-2022-0204
A heap overflow vulnerability was found in bluez in versions prior to 5.63