CVE-2021-3966CWE-122

Usb bluetooth device ACL read cb buffer overflow

Critical · published January 11, 2023

CVSS v3.1
9.6
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

🚨 A buffer overflow in the Bluetooth class of USB devices opens the door to chaos! 🔥 Think of this as a balloon that keeps getting filled with air beyond its limit — eventually, it pops, causing a mess everywhere! In our case, the overflow could let an attacker inject malicious code into your system, leading to all sorts of nefarious activities. If exploited, this flaw could allow an attacker to execute arbitrary code on your device, potentially taking over your system entirely! Imagine a hacker gaining unfettered access to your data, compromising your entire workspace. It's absolutely devastating for anyone reliant on USB Bluetooth connectivity.

Put simply

Think of this as a balloon that keeps getting filled with air beyond its limit — eventually, it pops, causing a mess everywhere! In our case, the overflow could let an attacker inject malicious code into your system, leading to all sorts of nefarious activities. CVE-2021-3966 involves a buffer overflow in the implementation of net_buf_add_mem within the USB Bluetooth class, allowing for malicious data to overwrite memory, leading to potential execution of arbitrary code.

What to do

If exploited, this flaw could allow an attacker to execute arbitrary code on your device, potentially taking over your system entirely! Imagine a hacker gaining unfettered access to your data, compromising your entire workspace. It's absolutely devastating for anyone reliant on USB Bluetooth connectivity. To protect your systems, urgently update the affected software component to the patched version. Review your USB Bluetooth devices for any additional security measures you can apply, such as limiting access. Don’t wait — the sooner you patch, the safer you’ll be! You've got this! Just follow the steps to lock this vulnerability down and keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-01-11T00:00Z
EPSS history
Timeline
  • 11 JAN 00:00Z
    Usb bluetooth device ACL read cb buffer overflow
    cvelistv5