CVE-2020-27153: 
NixOS vulnerability analysis and mitigation

CVE-2020-27153 affects BlueZ versions before 5.55, where a double free vulnerability was discovered in the gatttool disconnect_cb() routine from shared/att.c. The vulnerability was identified on October 14, 2020, and affects the Bluetooth protocol stack implementation for Linux systems (NVD).

The vulnerability is a double-free flaw in the disconnect_cb() routine, specifically occurring during service discovery after a Bluetooth Low Energy (BLE) connection has been established to a device. The issue arises due to a redundant disconnect MGMT event. The vulnerability has been assigned a CVSS v3.1 base score of 8.6 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (NVD, Ubuntu).

A remote attacker could potentially cause a denial of service or execute arbitrary code during service discovery. However, there is a small time window between the two calls to free(), making the path to actual code execution currently theoretical (Red Hat).

The vulnerability can be exploited by enticing a user to connect to a malicious GATT server or device. The attack occurs during service discovery after a Bluetooth Low Energy (BLE) connection has been established (Gentoo).

The primary mitigation is to upgrade BlueZ to version 5.55 or later. For systems that cannot be immediately updated, the vulnerability can be mitigated by only connecting the gatttool client to trusted GATT servers/devices. Additionally, disabling Bluetooth can serve as a temporary workaround (Red Hat).