CVE-2016-9798

In BlueZ 5.42, a use-after-free was identified in conf_opt function in tools/parser/l2cap.c source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name	Vendor	Start Version	End Version
Bluez	Bluez	5.42 (including)	5.42 (including)
Bluez	Ubuntu	artful	*
Bluez	Ubuntu	bionic	*
Bluez	Ubuntu	cosmic	*
Bluez	Ubuntu	disco	*
Bluez	Ubuntu	eoan	*
Bluez	Ubuntu	focal	*
Bluez	Ubuntu	groovy	*
Bluez	Ubuntu	hirsute	*
Bluez	Ubuntu	impish	*
Bluez	Ubuntu	kinetic	*
Bluez	Ubuntu	lunar	*
Bluez	Ubuntu	mantic	*
Bluez	Ubuntu	oracular	*
Bluez	Ubuntu	plucky	*
Bluez	Ubuntu	precise	*
Bluez	Ubuntu	trusty	*
Bluez	Ubuntu	vivid/stable-phone-overlay	*
Bluez	Ubuntu	xenial	*
Bluez	Ubuntu	yakkety	*
Bluez	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-9798
CWE	https://cwe.mitre.org/data/definitions/416.html

Use After Free

Weakness

Affected Software

Potential Mitigations

References