CVE-2021-43400
bluez: use-after-free in gatt-database.c
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 3.0 | bluez | 5.65-1.ph3 |
| Photon OS 4.0 | bluez, bluez-devel | 5.65-1.ph4 |
| debian 10 | bluez | 5.50-1.2~deb10u3 |
| debian 11 | bluez | 5.55-3.1+deb11u2 |
| debian 12 | bluez | 5.62-1 |
| debian 13 | bluez | 5.62-1 |
| debian 14 | bluez | 5.62-1 |
| debian 9 | bluez | kein Fix angegeben |
| echo | bluez | 5.62-1 |
| root.io debian 11 | rootio-bluez | 5.55-3.1+deb11u2 |
| root.io debian 12 | rootio-bluez | 5.62-1 |
| root.io debian 13 | rootio-bluez | 5.62-1 |
Alle 19 Einträge aus 18 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 3.0 | bluez | 5.65-1.ph3 |
| Photon OS 4.0 | bluez | 5.65-1.ph4 |
| Photon OS 4.0 | bluez-devel | 5.65-1.ph4 |
| debian 10 | bluez | 5.50-1.2~deb10u3 |
| debian 11 | bluez | 5.55-3.1+deb11u2 |
| debian 12 | bluez | 5.62-1 |
| debian 13 | bluez | 5.62-1 |
| debian 14 | bluez | 5.62-1 |
| debian 9 | bluez | kein Fix angegeben |
| echo | bluez | 5.62-1 |
| root.io debian 11 | rootio-bluez | 5.55-3.1+deb11u2 |
| root.io debian 12 | rootio-bluez | 5.62-1 |
| root.io debian 13 | rootio-bluez | 5.62-1 |
| ubuntu 18.04 | bluez | 5.48-0ubuntu3.6 |
| ubuntu 18.04-ESM | bluez | 5.48-0ubuntu3.6 |
| ubuntu 20.04 | bluez | 5.53-0ubuntu3.4 |
| ubuntu 20.04-ESM | bluez | 5.53-0ubuntu3.4 |
| ubuntu 21.04 | bluez | 5.56-0ubuntu4.3 |
| ubuntu 21.10 | bluez | 5.60-0ubuntu2.1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2021-43400
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=838c0dc7641e1c991c0f3027bf94bee4606012f8
- https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-43400
- https://ubuntu.com/security/notices/USN-5155-1
- https://www.cve.org/CVERecord?id=CVE-2021-43400