CVE-2023-50230: 
NixOS vulnerability analysis and mitigation

CVE-2023-50230 is a heap-based buffer overflow vulnerability in BlueZ's Phone Book Access profile. The vulnerability was discovered by Lucas Leong and disclosed on December 20, 2023. This security flaw affects BlueZ installations and requires user interaction in the form of connecting to a malicious Bluetooth device (ZDI Advisory).

The vulnerability exists within the handling of the Phone Book Access profile where there is a lack of proper validation of the length of user-supplied data before copying it to a fixed-length heap-based buffer. Primary/Secondary Counters are supposed to be 16 bytes values, and incorrect implementation by the server can lead to a heap-buffer-overflow. The vulnerability has been assigned a CVSS score of 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) (ZDI Advisory, GitHub Commit).

An attacker can leverage this vulnerability to execute arbitrary code in the context of root on affected installations of BlueZ. The vulnerability requires network-adjacent access and user interaction for successful exploitation (ZDI Advisory).

The vulnerability requires network-adjacent access and user interaction in the form of connecting to a malicious Bluetooth device. The attack complexity is considered high according to the CVSS scoring (ZDI Advisory).

BlueZ has released a patch to address this vulnerability. The fix involves adding proper length checking for Primary/Secondary Counters. Users are advised to update their BlueZ installations to the latest version. For Ubuntu users, a standard system update will make all the necessary changes (Ubuntu Notice, GitHub Commit).