CVE-2022-39176

What it actually does

Missing length validation on params_len in profiles/audio/avrcp.c permits out-of-bounds memory access over Bluetooth AVRCP, resulting in disclosure of adjacent heap or stack contents to a paired or discoverable peer.

Why it matters to the business

Nearby attackers can silently extract sensitive device or user data such as contact lists, media metadata, or internal state without authentication, increasing regulatory and reputational exposure for any product shipping the vulnerable Bluetooth stack.

How an attack unfolds

An attacker within Bluetooth range pairs or connects to the target device, sends a crafted AVRCP command packet with an invalid or oversized params_len field, and receives the resulting memory contents returned by the unvalidated handler.

How to fix it

Upgrade BlueZ to version 5.59 or later; the GIT tree is fixed by commit 1285bca9bde014a292e67632f83ef6e3386eb262. Rebuild and redeploy any downstream packages that statically link or bundle the vulnerable BlueZ libraries.

How to confirm the fix worked

Confirm the running bluetoothd binary or library reports version 5.59 or newer; inspect the source of profiles/audio/avrcp.c for the presence of the length check introduced in commit 1285bca9bde014a292e67632f83ef6e3386eb262; perform regression testing with malformed AVRCP packets to verify no memory disclosure occurs.

Typical attack path

1. Discover and connect to the target over Bluetooth
2. Issue a malformed AVRCP vendor-dependent or passthrough command containing an oversized or negative params_len
3. Receive the leaked memory buffer in the response
4. Parse disclosed data for credentials, keys, or other sensitive artifacts

How to detect it

Review Bluetooth daemon logs and HCI snoop traces for unexpected AVRCP command packets with anomalous length fields or repeated connection attempts from unknown addresses; correlate with any outbound memory-sized responses on the control channel.

What your security team should do

• Immediately inventory all systems and embedded devices using BlueZ versions prior to 5.59
• Apply the 5.59 update or the referenced commit through distribution channels or vendor firmware
• Disable Bluetooth when not required or restrict pairing to authenticated devices only
• Monitor vendor advisories for downstream products that embed the affected library