823802 – (CVE-2021-43400) <net-wireless/bluez-5.62: Use-after-free (CVE-2021-43400)

Bug 823802 (CVE-2021-43400) - <net-wireless/bluez-5.62: Use-after-free (CVE-2021-43400)

Summary: <net-wireless/bluez-5.62: Use-after-free (CVE-2021-43400)

Status:	RESOLVED FIXED

Alias:	CVE-2021-43400

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:	826886
Blocks:
	Show dependency tree

Reported:	2021-11-15 07:39 UTC by Sam James
Modified:	2022-03-26 21:48 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2021-11-15 07:39:14 UTC

Description:
"An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call."

Comment 1 Sam James archtester

2021-11-15 07:39:25 UTC

Please stable when ready, thanks!

Comment 2 John Helmert III archtester

2021-11-26 05:08:50 UTC

Please cleanup

Comment 3 Pacho Ramos gentoo-dev

2022-03-26 19:20:44 UTC

they were cleaned some time ago

Comment 4 John Helmert III archtester

2022-03-26 21:48:32 UTC

Yep, thanks! Low impact as it requires a client to be connected (so likely trusted), so no GLSA. All done!