Vulnerability Details : CVE-2020-27153
In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2020-27153
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
- cpe:2.3:a:bluez:bluez:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-27153
1.67%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 81 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-27153
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
8.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
3.9
|
4.7
|
NIST |
CWE ids for CVE-2020-27153
-
The product calls free() twice on the same memory address.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-27153
-
https://lists.debian.org/debian-lts-announce/2020/10/msg00022.html
[SECURITY] [DLA 2410-1] bluez security updateMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00034.html
[security-announce] openSUSE-SU-2020:1876-1: moderate: Security update fMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00036.html
[security-announce] openSUSE-SU-2020:1880-1: moderate: Security update fMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202011-01
BlueZ: Arbitrary code execution (GLSA 202011-01) — Gentoo securityThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1884817
1884817 – bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCEIssue Tracking;Third Party Advisory
-
https://github.com/bluez/bluez/commit/5a180f2ec9edfacafd95e5fed20d36fe8e077f07
Release 5.55 · bluez/bluez@5a180f2 · GitHubPatch;Third Party Advisory
-
https://github.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a
shared/att: Fix possible crash on disconnect · bluez/bluez@1cd644d · GitHubPatch;Third Party Advisory
-
https://www.debian.org/security/2021/dsa-4951
Debian -- Security Information -- DSA-4951-1 bluezThird Party Advisory
Jump to