cve-2023-27349
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2025-02-13 16:45
Severity ?
7.1 (High) - CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.
References
zdi-disclosures@trendmicro.comhttps://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9
zdi-disclosures@trendmicro.comhttps://lists.debian.org/debian-lts-announce/2024/05/msg00015.html
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-23-386/
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-23-386/
Impacted products
Vendor Product Version
BlueZ BlueZ Version: 5.66
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:bluez:bluez:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "bluez",
                  vendor: "bluez",
                  versions: [
                     {
                        status: "affected",
                        version: "-",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-27349",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-05-16T17:38:51.426068Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:24:49.193Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T12:09:43.408Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-23-386",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-23-386/",
               },
               {
                  name: "vendor-provided URL",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "BlueZ",
               vendor: "BlueZ",
               versions: [
                  {
                     status: "affected",
                     version: "5.66",
                  },
               ],
            },
         ],
         dateAssigned: "2023-02-28T18:05:54.030Z",
         datePublic: "2023-04-12T15:01:03.453Z",
         descriptions: [
            {
               lang: "en",
               value: "BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-129",
                     description: "CWE-129: Improper Validation of Array Index",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-06-10T16:12:55.458Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-23-386",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-23-386/",
            },
            {
               name: "vendor-provided URL",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9",
            },
            {
               url: "https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html",
            },
         ],
         source: {
            lang: "en",
            value: "Michael Randrianantenaina (https://elkamika.blogspot.com/)",
         },
         title: "BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2023-27349",
      datePublished: "2024-05-03T01:56:08.230Z",
      dateReserved: "2023-02-28T17:58:45.480Z",
      dateUpdated: "2025-02-13T16:45:22.212Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2023-27349\",\"sourceIdentifier\":\"zdi-disclosures@trendmicro.com\",\"published\":\"2024-05-03T02:15:13.140\",\"lastModified\":\"2024-11-21T07:52:42.657\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\\n\\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.\"},{\"lang\":\"es\",\"value\":\"Perfil de audio BlueZ AVRCP Validación inadecuada de la vulnerabilidad de ejecución remota de código del índice de matriz. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario a través de Bluetooth en instalaciones afectadas de BlueZ. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe conectarse a un dispositivo malicioso. La falla específica existe en el manejo del protocolo AVRCP. El problema se debe a la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Fue ZDI-CAN-19908.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"references\":[{\"url\":\"https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9\",\"source\":\"zdi-disclosures@trendmicro.com\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html\",\"source\":\"zdi-disclosures@trendmicro.com\"},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-23-386/\",\"source\":\"zdi-disclosures@trendmicro.com\"},{\"url\":\"https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-23-386/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-23-386/\", \"name\": \"ZDI-23-386\", \"tags\": [\"x_research-advisory\", \"x_transferred\"]}, {\"url\": \"https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9\", \"name\": \"vendor-provided URL\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T12:09:43.408Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-27349\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-16T17:38:51.426068Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:bluez:bluez:-:*:*:*:*:*:*:*\"], \"vendor\": \"bluez\", \"product\": \"bluez\", \"versions\": [{\"status\": \"affected\", \"version\": \"-\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-16T17:39:06.223Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability\", \"source\": {\"lang\": \"en\", \"value\": \"Michael Randrianantenaina (https://elkamika.blogspot.com/)\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"BlueZ\", \"product\": \"BlueZ\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.66\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2023-04-12T15:01:03.453Z\", \"references\": [{\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-23-386/\", \"name\": \"ZDI-23-386\", \"tags\": [\"x_research-advisory\"]}, {\"url\": \"https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9\", \"name\": \"vendor-provided URL\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html\"}], \"dateAssigned\": \"2023-02-28T18:05:54.030Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\\n\\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-129\", \"description\": \"CWE-129: Improper Validation of Array Index\"}]}], \"providerMetadata\": {\"orgId\": \"99f1926a-a320-47d8-bbb5-42feb611262e\", \"shortName\": \"zdi\", \"dateUpdated\": \"2024-06-10T16:12:55.458Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2023-27349\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T16:45:22.212Z\", \"dateReserved\": \"2023-02-28T17:58:45.480Z\", \"assignerOrgId\": \"99f1926a-a320-47d8-bbb5-42feb611262e\", \"datePublished\": \"2024-05-03T01:56:08.230Z\", \"assignerShortName\": \"zdi\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.