Hello, I would like to request a CVE ID for an Out-of-Bounds Read vulnerability (CWE-125) that was recently fixed in the official BlueZ Bluetooth stack.
Vulnerability Type: CWE-125 (Out-of-bounds Read) Component: profiles/audio/avrcp.c (AVRCP GetFolderItems parsing) Impact: A remote Bluetooth device acting as an AVRCP controller can send a specially crafted response with an inflated name length field but a short packet size, causing bluetoothd to read past the allocated packet buffer (Denial of Service / Information Disclosure). The vulnerability was discovered by me, and the patch has been officially accepted and applied to the BlueZ master branch by the maintainers (Red Hat / Intel). Fixed Commit: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=bd8989620ed6 Discoverer: Elman Shahbazov ([email protected]) Thank you, Elman Shahbazov
