CVE-2020-27153: Double Free (CWE-415)
value: In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 8.6
Published: 2020-10-15T03:15Z
Repository: https://github.com/bluez/bluez
Language: Other
Files changed: ChangeLog, configure.ac
Commit date: 2020-09-06 15:51:06 +0200
Commit message: Release 5.55

Diff: diff --git a/ChangeLog b/ChangeLog
index 25aef0d8f..1607cd61a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,28 @@
+ver 5.55:
+	Fix issue with handling security level for HoG.
+	Fix issue with handling HIDSDPDisable attribute.
+	Fix issue with handling HID virtual cable unplug.
+	Fix issue with handling HID channel disconnect order.
+	Fix issue with handling AVDTP delay reporting states.
+	Fix issue with handling AVRCP notification events.
+	Fix issue with handling AVRCP list player attributes.
+	Fix issue with handling AVRCP category 1 player settings.
+	Fix issue with handling AVRCP media player passthrough bitmask.
+	Fix issue with handling HFP 1.7 default features.
+	Fix issue with handling GATT disconnecting handling.
+	Fix issue with handling GATT database hash.
+	Fix issue with handling service changed characteristic.
+	Fix issue with handling read of multiple characteristic values.
+	Fix issue with handling Just-Works auto-accept pairing.
+	Fix issue with handling authentication of bonded devices.
+	Fix issue with handling L2CAP streaming mode for AVDTP.
+	Fix issue with handling SysEx parser for MIDI support.
+	Fix issue with handling configured scan parameter values.
+	Fix issue with handling temporary devices removal.
+	Fix issue with handling advertising flags.
+
 ver 5.54:
 	Fix issue with HOGP to accept data only from bonded devices.
 	Fix issue with A2DP sessions being connected at the same time.
 	Fix issue with class UUID matches before connecting profile.
 	Add support for handling MTU auto-tuning option for AVDTP.
diff --git a/configure.ac b/configure.ac
index 60ea6e31d..292dca615 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,7 +1,7 @@
 AC_PREREQ(2.60)
-AC_INIT(bluez, 5.54)
+AC_INIT(bluez, 5.55)
 
 AM_INIT_AUTOMAKE([foreign subdir-objects color-tests silent-rules
 					tar-pax no-dist-gzip dist-xz])
 AC_CONFIG_HEADERS(config.h)
 

Vulnerable code: AC_INIT(bluez, 5.54)
Fixed code: ver 5.55:
	Fix issue with handling security level for HoG.
	Fix issue with handling HIDSDPDisable attribute.
	Fix issue with handling HID virtual cable unplug.
	Fix issue with handling HID channel disconnect order.
	Fix issue with handling AVDTP delay reporting states.
	Fix issue with handling AVRCP notification events.
	Fix issue with handling AVRCP list player attributes.
	Fix issue with handling AVRCP category 1 player settings.
	Fix issue with handling AVRCP media player passthrough bitmask.
	Fix issue with handling HFP 1.7 default features.
	Fix issue with handling GATT disconnecting handling.
	Fix issue with handling GATT database hash.
	Fix issue with handling service changed characteristic.
	Fix issue with handling read of multiple characteristic values.
	Fix issue with handling Just-Works auto-accept pairing.
	Fix issue with handling authentication of bonded devices.
	Fix issue with handling L2CAP streaming mode for AVDTP.
	Fix issue with handling SysEx parser for MIDI support.
	Fix issue with handling configured scan parameter values.
	Fix issue with handling temporary devices removal.
	Fix issue with handling advertising flags.

AC_INIT(bluez, 5.55)