BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
bluekitchen gmbh:btstack
References 5
https://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a3…
Patch Commit
https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568
NVD
https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/avdtp.c#L1703
AVDTP L2CAP service registered at the stack default security level
https://github.com/bluekitchen/btstack
NVD
https://www.vulncheck.com/advisories/bluekitchen-btstack-through-1.8.2-a2dp-sep…
VulnCheck Advisory: BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write