CVE-2021-43400
bluez: use-after-free in gatt-database.c
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Ubuntu (medium).
Description
An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 3.0 | bluez | 5.65-1.ph3 |
| Photon OS 4.0 | bluez, bluez-devel | 5.65-1.ph4 |
| debian 10 | bluez | 5.50-1.2~deb10u3 |
| debian 11 | bluez | 5.55-3.1+deb11u2 |
| debian 12 | bluez | 5.62-1 |
| debian 13 | bluez | 5.62-1 |
| debian 14 | bluez | 5.62-1 |
| debian 9 | bluez | no fix listed |
| echo | bluez | 5.62-1 |
| root.io debian 11 | rootio-bluez | 5.55-3.1+deb11u2 |
| root.io debian 12 | rootio-bluez | 5.62-1 |
| root.io debian 13 | rootio-bluez | 5.62-1 |
Show all 19 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 3.0 | bluez | 5.65-1.ph3 |
| Photon OS 4.0 | bluez | 5.65-1.ph4 |
| Photon OS 4.0 | bluez-devel | 5.65-1.ph4 |
| debian 10 | bluez | 5.50-1.2~deb10u3 |
| debian 11 | bluez | 5.55-3.1+deb11u2 |
| debian 12 | bluez | 5.62-1 |
| debian 13 | bluez | 5.62-1 |
| debian 14 | bluez | 5.62-1 |
| debian 9 | bluez | no fix listed |
| echo | bluez | 5.62-1 |
| root.io debian 11 | rootio-bluez | 5.55-3.1+deb11u2 |
| root.io debian 12 | rootio-bluez | 5.62-1 |
| root.io debian 13 | rootio-bluez | 5.62-1 |
| ubuntu 18.04 | bluez | 5.48-0ubuntu3.6 |
| ubuntu 18.04-ESM | bluez | 5.48-0ubuntu3.6 |
| ubuntu 20.04 | bluez | 5.53-0ubuntu3.4 |
| ubuntu 20.04-ESM | bluez | 5.53-0ubuntu3.4 |
| ubuntu 21.04 | bluez | 5.56-0ubuntu4.3 |
| ubuntu 21.10 | bluez | 5.60-0ubuntu2.1 |
References
- https://access.redhat.com/security/cve/CVE-2021-43400
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=838c0dc7641e1c991c0f3027bf94bee4606012f8
- https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-43400
- https://ubuntu.com/security/notices/USN-5155-1
- https://www.cve.org/CVERecord?id=CVE-2021-43400