Executive brief
node-bluetooth is a Node.js library that enables Bluetooth serial port communication for applications. A buffer overflow vulnerability in the findSerialPortChannel method allows attackers to crash the application or execute arbitrary code by supplying oversized input without proper validation. This could compromise any application using this library to communicate with Bluetooth devices.
Technical details
The vulnerability is a classic buffer overflow (CWE-120) in the findSerialPortChannel method caused by insufficient input length validation. An attacker can send a crafted input larger than the allocated buffer to trigger a stack or heap overflow. The attack requires network or local access to the application and no authentication, as the method processes user-supplied data directly. Successful exploitation can lead to denial of service, information disclosure, or remote code execution. All versions up to and including 1.2.6 are affected; a patch is needed to validate input length before buffer operations.
Affected products
- node-bluetooth node-bluetooth all versions up to and including 1.2.6
Timeline
- 2023-03-09: disclosed