Executive brief
node-bluetooth-serial-port is a Node.js library that enables serial communication over Bluetooth connections, commonly used in IoT and embedded applications. A buffer overflow vulnerability in the findSerialPortChannel method allows an attacker to send malformed input that crashes the application or potentially executes arbitrary code, impacting the availability and security of any system relying on this library.
Technical details
The vulnerability is a classic buffer overflow (CWE-120) in the findSerialPortChannel method caused by insufficient validation of user-supplied input length. An attacker can provide oversized input that exceeds buffer boundaries, leading to memory corruption. The attack is network-reachable and requires no authentication or user interaction—an attacker can send a specially crafted Bluetooth serial message to trigger the overflow. Successful exploitation can result in denial of service (crash) or remote code execution. The advisory indicates all versions through 2.2.7 are affected; patch status is unknown from the provided data.
Affected products
- tinyprinter node-bluetooth-serial-port through 2.2.7
Timeline
- 2023-03-09: disclosed
- 2023-03-09: other: CVE-2023-26109 published