CVE-2019-8922
published 2021-11-29CVE-2019-8922: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination…
PriorityP347high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
1.43%
70.1th percentile
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bluez | bluez | <= 5.48 | — |
| bluez | bluez | >= 0 < 5.54-1 | 5.54-1 |
| bluez | bluez | >= 0 < 5.54-1 | 5.54-1 |
| bluez | bluez | >= 0 < 5.54-1 | 5.54-1 |
| bluez | bluez | >= 0 < 5.54-1 | 5.54-1 |
| bluez | bluez | >= 0 < 5.37-0ubuntu5.3+esm5 | 5.37-0ubuntu5.3+esm5 |
| debian | bluez | < bluez 5.54-1 (bookworm) | bluez 5.54-1 (bookworm) |
| debian | debian_linux | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
BlueZ vulnerabilities
vendor_ubuntu·2025-02-12·CVSS 6.5
CVE-2019-8921 [MEDIUM] BlueZ vulnerabilities
Title: BlueZ vulnerabilities
Summary: BlueZ could be made to crash or run programs as your login if it received
specially crafted Bluetooth requests.
Julian Rauchberger discovered that BlueZ did not correctly handle certain
memory operations. An attacker could possibly use this issue to leak
sensitive information or execute arbitrary code.
(CVE-2019-8921, CVE-2019-8922)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
BlueZ vulnerability
vendor_ubuntu·2021-12-08
CVE-2019-8922 BlueZ vulnerability
Title: BlueZ vulnerability
Summary: BlueZ could be made to crash or run programs if it received specially
crafted traffic.
Julian Rauchberger discovered that BlueZ incorrectly handled memory when
processing SDP attribute requests. A remote attacker could use this issue
to cause BlueZ to crash, leading to a denial of service, or possibly
execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
bluez: heap-based buffer overflow via crafted request
vendor_redhat·2019-02-25·CVSS 8.8
CVE-2019-8922 [HIGH] CWE-119 bluez: heap-based buffer overflow via crafted request
bluez: heap-based buffer overflow via crafted request
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.
A heap-based buffer overflow was discovered in bluetoothd in bluez through version 5.48. A missing check on whether there is enough space in th
Debian
CVE-2019-8922: bluez - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48....
vendor_debian·2019·CVSS 8.8
CVE-2019-8922 [HIGH] CVE-2019-8922: bluez - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48....
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.
Scope: local
bookworm: resolved (fixed in 5.54-1)
bullseye: resolved (fixed in 5.54-1)
forky: resolved (fixed in 5.54-1)
sid: resolved (fixed in 5.54-1)
trixie: resolved (fixed in 5.54-1)
VulDB
BlueZ up to 5.48 sdpd-request.c service_attr_req heap-based overflow (Nessus ID 216160)
vuldb·2026-04-16·CVSS 8.8
CVE-2019-8922 [HIGH] BlueZ up to 5.48 sdpd-request.c service_attr_req heap-based overflow (Nessus ID 216160)
A vulnerability was found in BlueZ up to 5.48. It has been classified as critical. This vulnerability affects the function service_attr_req of the file sdpd-request.c. Performing a manipulation results in heap-based buffer overflow.
This vulnerability is identified as CVE-2019-8922. The attack can only be performed from the local network. There is not any exploit available.
OSV
bluez vulnerabilities
osv·2025-02-12·CVSS 6.5
CVE-2019-8921 [MEDIUM] bluez vulnerabilities
bluez vulnerabilities
Julian Rauchberger discovered that BlueZ did not correctly handle certain
memory operations. An attacker could possibly use this issue to leak
sensitive information or execute arbitrary code.
(CVE-2019-8921, CVE-2019-8922)
GHSA
GHSA-r763-g6p5-r323: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5
ghsa_unreviewed·2021-11-30
CVE-2019-8922 [HIGH] CWE-787 GHSA-r763-g6p5-r323: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.
OSV
CVE-2019-8922: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5
osv·2021-11-29·CVSS 8.8
CVE-2019-8922 [HIGH] CVE-2019-8922: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5
A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.
No detection rules found.
No public exploits indexed.
https://lists.debian.org/debian-lts-announce/2022/10/msg00026.htmlhttps://security.netapp.com/advisory/ntap-20211203-0002/https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/https://lists.debian.org/debian-lts-announce/2022/10/msg00026.htmlhttps://security.netapp.com/advisory/ntap-20211203-0002/https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/
2021-11-29
Published