Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 823470 (CVE-2021-41229) - net-wireless/bluez: memory leak DoS
Summary: net-wireless/bluez: memory leak DoS
Status: CONFIRMED
Alias: CVE-2021-41229
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/bluez/bluez/securi...
Whiteboard: B3 [upstream]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-11-13 01:46 UTC by John Helmert III
Modified: 2021-11-13 01:46 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III gentoo-dev Security 2021-11-13 01:46:43 UTC
CVE-2021-41229:

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

No fixed version according to URL.