CVE-2021-3329CWE-703

DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer

Critical · published February 26, 2023

CVSS v3.1
9.6
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

🚨 A small oversight in Bluetooth stack initialization could send your devices crashing into chaos! 🔥 Think of it like a crowded restaurant; if the kitchen can't handle a sudden influx of orders, it might just shut down, leaving everyone waiting with empty plates. This vulnerability allows the Bluetooth stack to stumble and fall under pressure without proper validation. If exploited, this flaw could cause devices to crash unexpectedly, disrupting connectivity and potentially leading to a frustrating user experience. Imagine trying to connect to your favorite headphones or speaker, only to have your device freeze up! This could impact a wide range of products, from smartphones to smart home gadgets.

Put simply

Think of it like a crowded restaurant; if the kitchen can't handle a sudden influx of orders, it might just shut down, leaving everyone waiting with empty plates. This vulnerability allows the Bluetooth stack to stumble and fall under pressure without proper validation. CVE-2021-3329 arises from inadequate validation during the initialization phase of the HCI Host stack in Bluetooth implementations, which can lead to a crash when handling specific commands.

What to do

If exploited, this flaw could cause devices to crash unexpectedly, disrupting connectivity and potentially leading to a frustrating user experience. Imagine trying to connect to your favorite headphones or speaker, only to have your device freeze up! This could impact a wide range of products, from smartphones to smart home gadgets. To safeguard against this flaw, developers should patch their systems by updating to the latest firmware provided by the manufacturer. Additionally, ensure that thorough validation checks are implemented during the initialization process to prevent future mishaps. This is fixable! Stay proactive with your updates and keep your Bluetooth devices running smoothly! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00616 · 48.9th percentile
Weakness
CWE-703 · Improper Check or Handling of Exceptional Conditions
Published
2023-02-26T00:00Z
EPSS history
Timeline
  • 26 FEB 00:00Z
    DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer
    cvelistv5