Security readout for executives and security teams
Plain-English summary
BlueZ before 5.63 has a heap overflow that could let an unauthenticated nearby attacker disrupt affected Bluetooth services. The public description emphasizes application halt or crash, creating denial-of-service risk. Treat this as important where Bluetooth is enabled on Linux systems or embedded devices.
Executive priority
Prioritize remediation for Linux endpoints, appliances, and embedded systems where Bluetooth is enabled. This is not listed as actively exploited, but the high CVSS score and proximity-based unauthenticated attack path justify timely patching in exposed environments.
Technical view
CVE-2022-0204 is a CWE-119 heap overflow in BlueZ versions before 5.63. The CVSS 3.1 score is 8.8 with adjacent-network attack vector, low complexity, no privileges, and no user interaction. Public narrative cites crafted files causing halt or crash; broader CIA impact is reflected in the CVSS vector.
Likely exposure
Systems running BlueZ before 5.63 are in scope. Exposure is most relevant where Bluetooth is enabled and accessible from local or adjacent network proximity. Distro packages may contain backported fixes, so package advisory status matters more than upstream version alone.
Exploitation context
The supplied sources do not identify active exploitation, and KEV is false. The attack requires local or adjacent network access, not internet-wide reachability. Evidence provided supports denial-of-service impact; do not assume weaponized exploitation or broader compromise without vendor-specific evidence.
Researcher notes
The record links to an upstream BlueZ advisory and commit, plus Gentoo and Debian LTS updates. Public evidence is enough to identify affected upstream versions and remediation direction, but it does not establish active exploitation or provide detailed affected distribution package ranges.
Mitigation direction
- Upgrade BlueZ to 5.63 or a vendor package containing the fix.
- Apply relevant distribution security updates, including Gentoo GLSA or Debian LTS updates where applicable.
- Disable Bluetooth on systems that do not require it.
- Check vendor guidance for unsupported or embedded distributions.
Validation and detection
- Inventory Linux and embedded systems for installed BlueZ package versions.
- Confirm whether distro packages include the CVE-2022-0204 backport.
- Verify Bluetooth is disabled where business use is absent.
- Review patch status against vendor advisories, not only upstream version strings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-0204 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=2039807CVE reference
- https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2qCVE reference
- https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0CVE reference
- GLSA-202209-16CVE reference · vendor-advisory
- [debian-lts-announce] 20221024 [SECURITY] [DLA 3157-1] bluez security updateCVE reference · mailing-list
- https://lists.debian.org/debian-lts-announce/2024/09/msg00022.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.