CVE-2023-51592

What it actually does

Out-of-bounds read in the parse_media_folder function of the AVRCP profile within BlueZ, caused by insufficient validation of attacker-supplied data over Bluetooth, resulting in disclosure of adjacent memory contents.

Why it matters to the business

Exposure of sensitive information from Bluetooth-enabled Linux systems when a user connects to an attacker-controlled device, with potential for escalation to full system compromise when combined with additional vulnerabilities.

How an attack unfolds

An attacker deploys a malicious Bluetooth device that advertises AVRCP services; when the target system pairs or connects, the attacker supplies a crafted media folder response that triggers the out-of-bounds read, disclosing memory that can be leveraged with other flaws to achieve root-level code execution.

How to fix it

Apply the latest BlueZ package updates from the operating system distribution that address the AVRCP parsing flaw; disable Bluetooth functionality when not required.

How to confirm the fix worked

Verify the installed BlueZ version against distribution advisories, review Bluetooth stack source for the presence of bounds checks in parse_media_folder, and perform controlled testing with malformed AVRCP packets.

Typical attack path

1. Deploy a malicious Bluetooth device advertising AVRCP services
2. Induce the target system to connect via user interaction
3. Send a malformed media folder response during AVRCP handling
4. Read disclosed memory contents from the out-of-bounds access
5. Chain with additional vulnerabilities to execute arbitrary code as root

How to detect it

Review Bluetooth daemon logs for unexpected AVRCP connections or parsing errors, inspect system logs for anomalous media folder handling events, and correlate with nearby unknown Bluetooth device pairings.

What your security team should do

• Prioritize deployment of BlueZ security updates across all Linux endpoints with Bluetooth support
• Disable Bluetooth radios via policy or hardware switch where wireless audio or peripherals are unnecessary
• Monitor vendor and distribution security lists for BlueZ advisories