Security Bulletin: Vulnerability in BlueZ affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Vulnerability Details

CVEID:   CVE-2023-27349
DESCRIPTION:   BlueZ could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the handling of the AVRCP protocol. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CWE:   CWE-129: Improper Validation of Array Index
CVSS Source:   IBM X-Force
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2023-44431
DESCRIPTION:   BlueZ is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the AVRCP protocol. By persuading a victim to connect to a specially crafted device, a remote attacker could overflow a buffer and execute arbitrary code in the context of root.
CWE:   CWE-121: Stack-based Buffer Overflow
CVSS Source:   IBM X-Force
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2023-45866
DESCRIPTION:   Multiple UNIX-based products could allow a remote attacker to gain elevated privileges on the system, caused by a keystroke injection vulnerability in the HID Profile in multiple Bluetooth host stacks. By tricking the Bluetooth host state-machine into pairing with a fake keyboard without user confirmation, an attacker could exploit this vulnerability to connect to susceptible devices and transmit keystrokes to install apps and run arbitrary commands with elevated privileges.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM X-Force
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2023-50229
DESCRIPTION:   BlueZ is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the handling of the Phone Book Access profile. By persuading a victim to connect to a malicious Bluetooth device, a remote attacker could overflow a buffer and execute code in the context of root.
CWE:   CWE-122: Heap-based Buffer Overflow
CVSS Source:   IBM X-Force
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2023-50230
DESCRIPTION:   BlueZ is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the handling of the Phone Book Access profile. By persuading a victim to connect to a malicious Bluetooth device, a remote attacker could overflow a buffer and execute code in the context of root.
CWE:   CWE-122: Heap-based Buffer Overflow
CVSS Source:   IBM X-Force
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2023-51580
DESCRIPTION:   BlueZ could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read flaw in the handling of AVRCP protocol. By persuading a victim to connect to a specially crafted device, an attacker could exploit this vulnerability to read past the end of an allocated buffer, and use this information to launch further attacks against the affected system.
CWE:   CWE-125: Out-of-bounds Read
CVSS Source:   IBM X-Force
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2023-51589
DESCRIPTION:   BlueZ could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read flaw in the handling of AVRCP protocol. By persuading a victim to connect to a specially crafted device, an attacker could exploit this vulnerability to read past the end of an allocated buffer, and use this information to launch further attacks against the affected system.
CWE:   CWE-125: Out-of-bounds Read
CVSS Source:   IBM X-Force
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L)

CVEID:   CVE-2023-51592
DESCRIPTION:   BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20854.
CWE:   CWE-125: Out-of-bounds Read
CVSS Source:   IBM X-Force
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L)

CVEID:   CVE-2023-51594
DESCRIPTION:   BlueZ could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read flaw in the handling of OBEX protocol parameters. By persuading a victim to connect to a specially crafted device, an attacker could exploit this vulnerability to read past the end of an allocated buffer, and use this information to launch further attacks against the affected system.
CWE:   CWE-125: Out-of-bounds Read
CVSS Source:   IBM X-Force
CVSS Base score:   2.6
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID:   CVE-2023-51596
DESCRIPTION:   BlueZ is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the Phone Book Access profile. By persuading a victim to connect to a specially crafted device, a remote attacker could overflow a buffer and execute arbitrary code in the context of root.
CWE:   CWE-122: Heap-based Buffer Overflow
CVSS Source:   IBM X-Force
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)