CVE-2019-8921

An issue was discovered in bluetoothd in BlueZ through 5.48. The
vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP
implementation. By crafting a malicious CSTATE, it is possible to trick the
server into returning more bytes than the buffer actually holds, resulting
in leaking arbitrary heap data. The root cause can be found in the function
service_attr_req of sdpd-request.c. The server does not check whether the
CSTATE data is the same in consecutive requests, and instead simply trusts
that it is the same.

Notes