p PatchFirst

CVE-2021-41229

CVE-2021-41229 · Memory leak in BlueZ

This page contains facts from public vulnerability sources. Check the original advisory before updating.

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

CVSS 4.3 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • bluez

    Versions
    • = 5.58: Affected

    No fix published

  • bluez Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.62-2

    Update to 5.62-2

  • bluez Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.62-2

    Update to 5.62-2

  • bluez Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.62-2

    Update to 5.62-2

  • bluez Ubuntu:Pro:16.04:LTS

    Versions
    • 5.35-0ubuntu2
    • 5.36-0ubuntu1
    • 5.37-0ubuntu5
    • 5.37-0ubuntu5.1
    • 5.37-0ubuntu5.3
    • 5.37-0ubuntu5.3+esm1
    • 5.37-0ubuntu5.3+esm2
    • 5.37-0ubuntu5.3+esm3
    • 5.37-0ubuntu5.3+esm4
    • 5.37-0ubuntu5.3+esm5
    • 5.37-0ubuntu5.3+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bluez Ubuntu:18.04:LTS

    Versions
    • 5.46-0ubuntu3
    • 5.46-0ubuntu4
    • 5.48-0ubuntu3
    • 5.48-0ubuntu3.1
    • 5.48-0ubuntu3.2
    • 5.48-0ubuntu3.3
    • 5.48-0ubuntu3.4
    • 5.48-0ubuntu3.5
    Affected ranges
    • ECOSYSTEM: < 5.48-0ubuntu3.6

    Update to 5.48-0ubuntu3.6

  • bluez Ubuntu:20.04:LTS

    Versions
    • 5.50-0ubuntu4
    • 5.51-0ubuntu1
    • 5.51-0ubuntu2
    • 5.52-0ubuntu1
    • 5.52-0ubuntu2
    • 5.53-0ubuntu1
    • 5.53-0ubuntu2
    • 5.53-0ubuntu3
    • 5.53-0ubuntu3.1
    • 5.53-0ubuntu3.2
    • 5.53-0ubuntu3.3
    Affected ranges
    • ECOSYSTEM: < 5.53-0ubuntu3.4

    Update to 5.53-0ubuntu3.4

  • bluez Ubuntu:22.04:LTS

    Versions
    • 5.60-0ubuntu2
    • 5.62-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 5.62-0ubuntu2

    Update to 5.62-0ubuntu2

Original sources

Check your server →