Description

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-25T22:17:07.427Z",
  "pubdate": "2026-08-25T22:17:07.427Z",
  "executiveSummary": "This vulnerability involves a type confusion flaw within the BlueZ Bluetooth stack, specifically residing in the sdp-xml.c component.\nThe issue manifests when the RegisterProfile method processes a maliciously crafted ServiceRecord containing nested structures.\nA local attacker can trigger this vulnerability to cause a crash of the bluetoothd daemon, resulting in a local Denial of Service (DoS).\nThe flaw stems from the improper handling of union data types within the SDP XML parser stack, where scalar data is incorrectly interpreted as a sequence pointer.\nSuccessful exploitation requires local access to the system to interact with the Bluetooth stack via D-Bus or equivalent IPC mechanisms.\nThe risk is primarily limited to service availability, as the crash disrupts Bluetooth functionality until the service is manually or automatically restarted.\nNo remote code execution or privilege escalation is inherently linked to this specific memory corruption event based on the provided analysis.",
  "technicalDetails": "The vulnerability resides in the BlueZ sdp-xml.c source file, which is responsible for parsing Service Discovery Protocol (SDP) XML records provided during the RegisterProfile operation.\nThe root cause is a type confusion bug occurring during the recursive parsing of nested ServiceRecord XML elements.\nThe SDP parser utilizes a union data structure to store either scalar values or pointers to sequences. During the parsing logic, the internal state machine fails to validate the current element type before accessing the union member.\nWhen a crafted, deeply nested ServiceRecord is provided, the parser incorrectly treats a scalar union member as a sequence pointer.\nThis leads to an illegal memory access or an invalid pointer dereference when the code attempts to traverse or process the presumed sequence pointer.\nThe attack flow initiates when an attacker invokes the RegisterProfile method through the Bluetooth D-Bus API, passing a payload containing the malicious XML record.\nThe bluetoothd process receives this data and passes it to the parser within sdp-xml.c. As the parser hits the malformed nesting, it misinterprets the memory layout, corrupting the execution flow.\nBecause the memory access violates the expected structure defined in the union, the process triggers an unhandled signal, such as a segmentation fault (SIGSEGV), leading to an immediate crash of the bluetoothd daemon.\nThis vulnerability is restricted to local attackers who possess sufficient permissions to communicate with the Bluetooth subsystem on the host.\nThe impact is a localized Denial of Service, as the primary mechanism for Bluetooth interaction (bluetoothd) is terminated.\nThe defect highlights a lack of sufficient structural validation and type-checking guards within the XML parsing logic of the SDP stack when dealing with untrusted user-supplied record definitions."
}