CVE-2022-0204

HIGH

Published Mar 10, 20224y ago · Modified Jun 17, 20262w ago

8.8 CVSS 3.1

High

Published Mar 10, 2022 4y ago

Last Modified Jun 17, 2026 2w ago

Description

A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Adjacent

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 2

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 3

Vendor	Product	Version	Range
bluez	bluez	*	<5.63
fedoraproject	fedora	35	any
debian	debian_linux	10.0	any

References 6

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2039807

Issue TrackingPatchThird Party Advisory
github.com https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0

PatchThird Party Advisory
github.com https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q

ExploitThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html

Mailing ListThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html
security.gentoo.org https://security.gentoo.org/glsa/202209-16

Third Party Advisory

Remediation

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2039807

Issue TrackingPatchThird Party Advisory
github.com https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0

PatchThird Party Advisory