CVE-2022-39177: 
NixOS vulnerability analysis and mitigation

BlueZ before version 5.59 contains a vulnerability (CVE-2022-39177) that allows physically proximate attackers to cause a denial of service. The vulnerability exists because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c. This vulnerability was discovered and disclosed on September 2, 2022 (CVE-MITRE).

The vulnerability has been assigned a CVSS 3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically relates to the processing of malformed and invalid capabilities in the profiles/audio/avdtp.c file of the BlueZ codebase (NetApp-Advisory).

Successful exploitation of this vulnerability could lead to a denial of service condition in affected BlueZ installations. The attack requires physical proximity to the target device (Ubuntu-Security).

The vulnerability has been fixed in BlueZ version 5.59 and later. Various distributions have released security updates to address this issue: Ubuntu 20.04 LTS has been updated to version 5.53-0ubuntu3.6, and Ubuntu 18.04 LTS to version 5.48-0ubuntu3.9 (Ubuntu-Notice).