CVE-2019-8921: 
NixOS vulnerability analysis and mitigation

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVCATTRREQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function serviceattrreq of sdpd-request.c (NVD).

The vulnerability exists in the SDP (Service Discovery Protocol) implementation of BlueZ. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same. By manipulating the CSTATE data in the second request, an attacker can cause an underflow when calculating (pCache->data_size - cstate->cStateValue.maxBytesSent), which results in leaking arbitrary heap data. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (SSD Disclosure).

The vulnerability allows an attacker to leak sensitive information from the heap memory. If exploited, an attacker can either leak up to 0x7FFF bytes of heap data or cause a denial of service by crashing the bluetooth application when setting the leak size to 0x8000 or larger (SSD Disclosure).

The vulnerability affects BlueZ versions through 5.48. Users should update to a patched version of BlueZ. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu, Debian, and NetApp products (Ubuntu Notice, Debian Notice).