CVE-2023-51589: 
NixOS vulnerability analysis and mitigation

BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2023-51589) affects BlueZ installations. The vulnerability was discovered by Lucas Leong of Trend Micro Zero Day Initiative and was initially reported on April 7, 2023, with public disclosure on December 21, 2023. This security flaw affects the Bluetooth implementation in BlueZ, particularly within the handling of the AVRCP protocol (Zero Day Initiative).

The vulnerability stems from improper validation of user-supplied data in the AVRCP protocol handling, specifically within the parse_media_element function. This implementation flaw can result in a read operation past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 5.4 (Medium), with the vector string CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L, indicating adjacent network attack vector with high complexity and requiring user interaction (Zero Day Initiative).

The vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. When combined with other vulnerabilities, this flaw could potentially be leveraged to execute arbitrary code in the context of root. The impact is heightened in scenarios where the target connects to a malicious device (Zero Day Initiative).

Exploitation of this vulnerability requires network-adjacent access and user interaction, specifically the target must connect to a malicious device. The vulnerability was tracked as ZDI-CAN-20853 and requires high attack complexity to exploit successfully (Zero Day Initiative).

Given the nature of the vulnerability, the primary mitigation strategy is to restrict interaction with the application. Red Hat has released security updates for affected versions of BlueZ in Red Hat Enterprise Linux 9 (Red Hat).