CVE-2022-39177

What it actually does

Malformed or invalid capabilities in the AVDTP profile handler in profiles/audio/avdtp.c allow an unauthenticated adjacent attacker to trigger crashes or resource exhaustion, resulting in denial of service for Bluetooth audio functionality.

Why it matters to the business

Nearby attackers can disrupt Bluetooth audio devices on Linux systems, causing intermittent loss of wireless audio, headset, or speaker functionality until the affected process is restarted; the issue is limited to physically proximate threats and has not been observed in ransomware or widespread campaigns.

How an attack unfolds

An attacker within Bluetooth range crafts and sends malformed capability packets over the AVDTP protocol; the BlueZ daemon processes these invalid values without sufficient validation, leading to a crash or hang in the audio profile handler.

How to fix it

Upgrade BlueZ to version 5.59 or later; apply the fix from commit 1285bca9bde014a292e67632f83ef6e3386eb262 in the GIT repository; rebuild and deploy the updated package across all affected Linux systems.

How to confirm the fix worked

Verify the installed BlueZ version is 5.59 or newer; confirm the commit 1285bca9bde014a292e67632f83ef6e3386eb262 is present in the source tree; test Bluetooth audio pairing and streaming after the update to ensure no regression.

Typical attack path

1. Establish physical proximity to the target Bluetooth device
2. Send crafted AVDTP capability packets containing invalid or oversized values
3. Trigger unhandled processing path in profiles/audio/avdtp.c resulting in DoS
4. Observe service crash or audio stack unavailability

How to detect it

Review BlueZ daemon logs and system crash reports for entries referencing profiles/audio/avdtp.c or capability parsing failures; correlate with Bluetooth connection attempts from unknown nearby devices.

• profiles/audio/avdtp.c
• avdtp.*capability
• bluetoothd.*crash.*avdtp

What your security team should do

• Prioritize patching systems that expose Bluetooth audio profiles to untrusted adjacent networks
• Monitor vendor advisories for downstream distributions shipping BlueZ
• Consider disabling unnecessary Bluetooth audio services until patches are applied