Headline
CVE-2022-0204: heap-based buffer overflow in the implementation of the gatt protocol
A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.
Comment 1 Guilherme de Almeida Suckevicz 2022-01-12 13:40:37 UTC
Created bluez tracking bugs for this issue:
Affects: fedora-all [bug 2039808]
Comment 3 juneau 2022-01-12 15:06:24 UTC
Marking services not affected for Bluetooth vulnerability.
Comment 5 John Helmert III 2022-03-19 05:10:12 UTC
The Github advisory referenced by the CVE (https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q) seems to claim this vulnerability can result in remote code execution, but the CVE says the impact is only denial of service. Why the discrepancy?
Also, for the benefit of downstreams, can a reference to the patch be added to the CVE?