USN-8908-1: BlueZ vulnerabilities

BlueZ, the standard Bluetooth protocol stack for Linux, contains a stack-based buffer overflow (CWE-121) in its handling of A2DP stream endpoints, disclosed by ZDI as ZDI-26-589. The flaw stems from failure to validate the length of attacker-supplied data before copying it into a fixed-length stack buffer. A network-adjacent attacker must first pair a malicious Bluetooth device with the target system — which requires physical/proximity access and typically user interaction to accept pairing — after which successful exploitation yields arbitrary code execution in the context of root. Any Linux system running a vulnerable BlueZ build with Bluetooth enabled and A2DP audio profiles exposed is potentially at risk. No public proof-of-concept exists and the vulnerability is not listed in CISA's KEV catalog, so exploitation status is currently none known.

Do: Update BlueZ to the latest package released through your Linux distribution's package manager as soon as a patched build is available. In the interim, disable Bluetooth or set adapters to non-discoverable/non-pairable mode on systems that do not need A2DP audio, and reject or review unexpected inbound pairing requests. Verify that audio services (PipeWire/PulseAudio Bluetooth modules) are only enabled on hosts where Bluetooth audio is actually required.

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.