CVE-2021-41229 - CVE House
Back to Database
Status published Medium CVE-2021-41229

Memory leak in BlueZ

Vulnerability Description

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41229

Credits & Attribution

No credits recorded in the NVD database.

References

More from bluez

View All →
CVE-2022-39177
BlueZ before 5.59 allows physically proximate attackers to cause a...
Unknown 0
CVE-2022-39176
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive...
Unknown 0
CVE-2021-43400
An issue was discovered in gatt-database.c in BlueZ 5.61. A...
Critical 9.1
CVE-2020-27153
In BlueZ before 5.55, a double free was found in...
Unknown 0
CVE-2019-8922
A heap-based buffer overflow was discovered in bluetoothd in BlueZ...
Unknown 0

Affected Vendor

Affected Software

bluez
Vulnerable Versions:
= 5.58

Timeline

Official Publish: November 12th, 2021
Last Modified: November 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact