Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2019-8921

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.0%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 3.3
Products affected by CVE-2019-8921
  • Bluez » Bluez » Version: N/A
    cpe:2.3:a:bluez:bluez:-
  • Bluez » Bluez » Version: 4.0
    cpe:2.3:a:bluez:bluez:4.0
  • Bluez » Bluez » Version: 4.1
    cpe:2.3:a:bluez:bluez:4.1
  • Bluez » Bluez » Version: 4.10
    cpe:2.3:a:bluez:bluez:4.10
  • Bluez » Bluez » Version: 4.100
    cpe:2.3:a:bluez:bluez:4.100
  • Bluez » Bluez » Version: 4.101
    cpe:2.3:a:bluez:bluez:4.101
  • Bluez » Bluez » Version: 4.11
    cpe:2.3:a:bluez:bluez:4.11
  • Bluez » Bluez » Version: 4.12
    cpe:2.3:a:bluez:bluez:4.12
  • Bluez » Bluez » Version: 4.13
    cpe:2.3:a:bluez:bluez:4.13
  • Bluez » Bluez » Version: 4.14
    cpe:2.3:a:bluez:bluez:4.14
  • Bluez » Bluez » Version: 4.15
    cpe:2.3:a:bluez:bluez:4.15
  • Bluez » Bluez » Version: 4.16
    cpe:2.3:a:bluez:bluez:4.16
  • Bluez » Bluez » Version: 4.17
    cpe:2.3:a:bluez:bluez:4.17
  • Bluez » Bluez » Version: 4.18
    cpe:2.3:a:bluez:bluez:4.18
  • Bluez » Bluez » Version: 4.19
    cpe:2.3:a:bluez:bluez:4.19
  • Bluez » Bluez » Version: 4.2
    cpe:2.3:a:bluez:bluez:4.2
  • Bluez » Bluez » Version: 4.20
    cpe:2.3:a:bluez:bluez:4.20
  • Bluez » Bluez » Version: 4.21
    cpe:2.3:a:bluez:bluez:4.21
  • Bluez » Bluez » Version: 4.22
    cpe:2.3:a:bluez:bluez:4.22
  • Bluez » Bluez » Version: 4.23
    cpe:2.3:a:bluez:bluez:4.23
  • Bluez » Bluez » Version: 4.24
    cpe:2.3:a:bluez:bluez:4.24
  • Bluez » Bluez » Version: 4.25
    cpe:2.3:a:bluez:bluez:4.25
  • Bluez » Bluez » Version: 4.26
    cpe:2.3:a:bluez:bluez:4.26
  • Bluez » Bluez » Version: 4.27
    cpe:2.3:a:bluez:bluez:4.27
  • Bluez » Bluez » Version: 4.28
    cpe:2.3:a:bluez:bluez:4.28
  • Bluez » Bluez » Version: 4.29
    cpe:2.3:a:bluez:bluez:4.29
  • Bluez » Bluez » Version: 4.3
    cpe:2.3:a:bluez:bluez:4.3
  • Bluez » Bluez » Version: 4.30
    cpe:2.3:a:bluez:bluez:4.30
  • Bluez » Bluez » Version: 4.31
    cpe:2.3:a:bluez:bluez:4.31
  • Bluez » Bluez » Version: 4.32
    cpe:2.3:a:bluez:bluez:4.32
  • Bluez » Bluez » Version: 4.33
    cpe:2.3:a:bluez:bluez:4.33
  • Bluez » Bluez » Version: 4.34
    cpe:2.3:a:bluez:bluez:4.34
  • Bluez » Bluez » Version: 4.35
    cpe:2.3:a:bluez:bluez:4.35
  • Bluez » Bluez » Version: 4.36
    cpe:2.3:a:bluez:bluez:4.36
  • Bluez » Bluez » Version: 4.37
    cpe:2.3:a:bluez:bluez:4.37
  • Bluez » Bluez » Version: 4.38
    cpe:2.3:a:bluez:bluez:4.38
  • Bluez » Bluez » Version: 4.39
    cpe:2.3:a:bluez:bluez:4.39
  • Bluez » Bluez » Version: 4.4
    cpe:2.3:a:bluez:bluez:4.4
  • Bluez » Bluez » Version: 4.40
    cpe:2.3:a:bluez:bluez:4.40
  • Bluez » Bluez » Version: 4.41
    cpe:2.3:a:bluez:bluez:4.41
  • Bluez » Bluez » Version: 4.42
    cpe:2.3:a:bluez:bluez:4.42
  • Bluez » Bluez » Version: 4.43
    cpe:2.3:a:bluez:bluez:4.43
  • Bluez » Bluez » Version: 4.44
    cpe:2.3:a:bluez:bluez:4.44
  • Bluez » Bluez » Version: 4.45
    cpe:2.3:a:bluez:bluez:4.45
  • Bluez » Bluez » Version: 4.46
    cpe:2.3:a:bluez:bluez:4.46
  • Bluez » Bluez » Version: 4.47
    cpe:2.3:a:bluez:bluez:4.47
  • Bluez » Bluez » Version: 4.48
    cpe:2.3:a:bluez:bluez:4.48
  • Bluez » Bluez » Version: 4.49
    cpe:2.3:a:bluez:bluez:4.49
  • Bluez » Bluez » Version: 4.5
    cpe:2.3:a:bluez:bluez:4.5
  • Bluez » Bluez » Version: 4.50
    cpe:2.3:a:bluez:bluez:4.50
  • Bluez » Bluez » Version: 4.51
    cpe:2.3:a:bluez:bluez:4.51
  • Bluez » Bluez » Version: 4.52
    cpe:2.3:a:bluez:bluez:4.52
  • Bluez » Bluez » Version: 4.53
    cpe:2.3:a:bluez:bluez:4.53
  • Bluez » Bluez » Version: 4.54
    cpe:2.3:a:bluez:bluez:4.54
  • Bluez » Bluez » Version: 4.55
    cpe:2.3:a:bluez:bluez:4.55
  • Bluez » Bluez » Version: 4.56
    cpe:2.3:a:bluez:bluez:4.56
  • Bluez » Bluez » Version: 4.57
    cpe:2.3:a:bluez:bluez:4.57
  • Bluez » Bluez » Version: 4.58
    cpe:2.3:a:bluez:bluez:4.58
  • Bluez » Bluez » Version: 4.59
    cpe:2.3:a:bluez:bluez:4.59
  • Bluez » Bluez » Version: 4.6
    cpe:2.3:a:bluez:bluez:4.6
  • Bluez » Bluez » Version: 4.60
    cpe:2.3:a:bluez:bluez:4.60
  • Bluez » Bluez » Version: 4.61
    cpe:2.3:a:bluez:bluez:4.61
  • Bluez » Bluez » Version: 4.62
    cpe:2.3:a:bluez:bluez:4.62
  • Bluez » Bluez » Version: 4.63
    cpe:2.3:a:bluez:bluez:4.63
  • Bluez » Bluez » Version: 4.64
    cpe:2.3:a:bluez:bluez:4.64
  • Bluez » Bluez » Version: 4.65
    cpe:2.3:a:bluez:bluez:4.65
  • Bluez » Bluez » Version: 4.66
    cpe:2.3:a:bluez:bluez:4.66
  • Bluez » Bluez » Version: 4.67
    cpe:2.3:a:bluez:bluez:4.67
  • Bluez » Bluez » Version: 4.68
    cpe:2.3:a:bluez:bluez:4.68
  • Bluez » Bluez » Version: 4.69
    cpe:2.3:a:bluez:bluez:4.69
  • Bluez » Bluez » Version: 4.7
    cpe:2.3:a:bluez:bluez:4.7
  • Bluez » Bluez » Version: 4.70
    cpe:2.3:a:bluez:bluez:4.70
  • Bluez » Bluez » Version: 4.71
    cpe:2.3:a:bluez:bluez:4.71
  • Bluez » Bluez » Version: 4.72
    cpe:2.3:a:bluez:bluez:4.72
  • Bluez » Bluez » Version: 4.73
    cpe:2.3:a:bluez:bluez:4.73
  • Bluez » Bluez » Version: 4.74
    cpe:2.3:a:bluez:bluez:4.74
  • Bluez » Bluez » Version: 4.75
    cpe:2.3:a:bluez:bluez:4.75
  • Bluez » Bluez » Version: 4.76
    cpe:2.3:a:bluez:bluez:4.76
  • Bluez » Bluez » Version: 4.77
    cpe:2.3:a:bluez:bluez:4.77
  • Bluez » Bluez » Version: 4.78
    cpe:2.3:a:bluez:bluez:4.78
  • Bluez » Bluez » Version: 4.79
    cpe:2.3:a:bluez:bluez:4.79
  • Bluez » Bluez » Version: 4.8
    cpe:2.3:a:bluez:bluez:4.8
  • Bluez » Bluez » Version: 4.80
    cpe:2.3:a:bluez:bluez:4.80
  • Bluez » Bluez » Version: 4.81
    cpe:2.3:a:bluez:bluez:4.81
  • Bluez » Bluez » Version: 4.82
    cpe:2.3:a:bluez:bluez:4.82
  • Bluez » Bluez » Version: 4.83
    cpe:2.3:a:bluez:bluez:4.83
  • Bluez » Bluez » Version: 4.84
    cpe:2.3:a:bluez:bluez:4.84
  • Bluez » Bluez » Version: 4.85
    cpe:2.3:a:bluez:bluez:4.85
  • Bluez » Bluez » Version: 4.86
    cpe:2.3:a:bluez:bluez:4.86
  • Bluez » Bluez » Version: 4.87
    cpe:2.3:a:bluez:bluez:4.87
  • Bluez » Bluez » Version: 4.88
    cpe:2.3:a:bluez:bluez:4.88
  • Bluez » Bluez » Version: 4.89
    cpe:2.3:a:bluez:bluez:4.89
  • Bluez » Bluez » Version: 4.9
    cpe:2.3:a:bluez:bluez:4.9
  • Bluez » Bluez » Version: 4.90
    cpe:2.3:a:bluez:bluez:4.90
  • Bluez » Bluez » Version: 4.91
    cpe:2.3:a:bluez:bluez:4.91
  • Bluez » Bluez » Version: 4.92
    cpe:2.3:a:bluez:bluez:4.92
  • Bluez » Bluez » Version: 4.93
    cpe:2.3:a:bluez:bluez:4.93
  • Bluez » Bluez » Version: 4.94
    cpe:2.3:a:bluez:bluez:4.94
  • Bluez » Bluez » Version: 4.95
    cpe:2.3:a:bluez:bluez:4.95
  • Bluez » Bluez » Version: 4.96
    cpe:2.3:a:bluez:bluez:4.96
  • Bluez » Bluez » Version: 4.97
    cpe:2.3:a:bluez:bluez:4.97
  • Bluez » Bluez » Version: 4.98
    cpe:2.3:a:bluez:bluez:4.98
  • Bluez » Bluez » Version: 4.99
    cpe:2.3:a:bluez:bluez:4.99
  • Bluez » Bluez » Version: 5.0
    cpe:2.3:a:bluez:bluez:5.0
  • Bluez » Bluez » Version: 5.1
    cpe:2.3:a:bluez:bluez:5.1
  • Bluez » Bluez » Version: 5.10
    cpe:2.3:a:bluez:bluez:5.10
  • Bluez » Bluez » Version: 5.11
    cpe:2.3:a:bluez:bluez:5.11
  • Bluez » Bluez » Version: 5.12
    cpe:2.3:a:bluez:bluez:5.12
  • Bluez » Bluez » Version: 5.13
    cpe:2.3:a:bluez:bluez:5.13
  • Bluez » Bluez » Version: 5.14
    cpe:2.3:a:bluez:bluez:5.14
  • Bluez » Bluez » Version: 5.15
    cpe:2.3:a:bluez:bluez:5.15
  • Bluez » Bluez » Version: 5.16
    cpe:2.3:a:bluez:bluez:5.16
  • Bluez » Bluez » Version: 5.17
    cpe:2.3:a:bluez:bluez:5.17
  • Bluez » Bluez » Version: 5.18
    cpe:2.3:a:bluez:bluez:5.18
  • Bluez » Bluez » Version: 5.19
    cpe:2.3:a:bluez:bluez:5.19
  • Bluez » Bluez » Version: 5.2
    cpe:2.3:a:bluez:bluez:5.2
  • Bluez » Bluez » Version: 5.20
    cpe:2.3:a:bluez:bluez:5.20
  • Bluez » Bluez » Version: 5.21
    cpe:2.3:a:bluez:bluez:5.21
  • Bluez » Bluez » Version: 5.22
    cpe:2.3:a:bluez:bluez:5.22
  • Bluez » Bluez » Version: 5.23
    cpe:2.3:a:bluez:bluez:5.23
  • Bluez » Bluez » Version: 5.24
    cpe:2.3:a:bluez:bluez:5.24
  • Bluez » Bluez » Version: 5.25
    cpe:2.3:a:bluez:bluez:5.25
  • Bluez » Bluez » Version: 5.26
    cpe:2.3:a:bluez:bluez:5.26
  • Bluez » Bluez » Version: 5.27
    cpe:2.3:a:bluez:bluez:5.27
  • Bluez » Bluez » Version: 5.28
    cpe:2.3:a:bluez:bluez:5.28
  • Bluez » Bluez » Version: 5.29
    cpe:2.3:a:bluez:bluez:5.29
  • Bluez » Bluez » Version: 5.3
    cpe:2.3:a:bluez:bluez:5.3
  • Bluez » Bluez » Version: 5.30
    cpe:2.3:a:bluez:bluez:5.30
  • Bluez » Bluez » Version: 5.31
    cpe:2.3:a:bluez:bluez:5.31
  • Bluez » Bluez » Version: 5.32
    cpe:2.3:a:bluez:bluez:5.32
  • Bluez » Bluez » Version: 5.33
    cpe:2.3:a:bluez:bluez:5.33
  • Bluez » Bluez » Version: 5.34
    cpe:2.3:a:bluez:bluez:5.34
  • Bluez » Bluez » Version: 5.35
    cpe:2.3:a:bluez:bluez:5.35
  • Bluez » Bluez » Version: 5.36
    cpe:2.3:a:bluez:bluez:5.36
  • Bluez » Bluez » Version: 5.37
    cpe:2.3:a:bluez:bluez:5.37
  • Bluez » Bluez » Version: 5.38
    cpe:2.3:a:bluez:bluez:5.38
  • Bluez » Bluez » Version: 5.39
    cpe:2.3:a:bluez:bluez:5.39
  • Bluez » Bluez » Version: 5.4
    cpe:2.3:a:bluez:bluez:5.4
  • Bluez » Bluez » Version: 5.40
    cpe:2.3:a:bluez:bluez:5.40
  • Bluez » Bluez » Version: 5.41
    cpe:2.3:a:bluez:bluez:5.41
  • Bluez » Bluez » Version: 5.42
    cpe:2.3:a:bluez:bluez:5.42
  • Bluez » Bluez » Version: 5.43
    cpe:2.3:a:bluez:bluez:5.43
  • Bluez » Bluez » Version: 5.44
    cpe:2.3:a:bluez:bluez:5.44
  • Bluez » Bluez » Version: 5.45
    cpe:2.3:a:bluez:bluez:5.45
  • Bluez » Bluez » Version: 5.46
    cpe:2.3:a:bluez:bluez:5.46
  • Bluez » Bluez » Version: 5.47
    cpe:2.3:a:bluez:bluez:5.47
  • Bluez » Bluez » Version: 5.48
    cpe:2.3:a:bluez:bluez:5.48
  • Bluez » Bluez » Version: 5.5
    cpe:2.3:a:bluez:bluez:5.5
  • Bluez » Bluez » Version: 5.6
    cpe:2.3:a:bluez:bluez:5.6
  • Bluez » Bluez » Version: 5.7
    cpe:2.3:a:bluez:bluez:5.7
  • Bluez » Bluez » Version: 5.8
    cpe:2.3:a:bluez:bluez:5.8
  • Bluez » Bluez » Version: 5.9
    cpe:2.3:a:bluez:bluez:5.9
  • Debian » Debian Linux » Version: 10.0
    cpe:2.3:o:debian:debian_linux:10.0
  • Linux » Linux Kernel » Version: N/A
    cpe:2.3:o:linux:linux_kernel:-


Products
Pricing
Contact Us

Shodan ® - All rights reserved