toothpicker

ToothPicker ToothPicker 是一个进程内、覆盖引导的 iOS 模糊测试工具。它专门针对 iOS 的蓝牙守护进程 bluetoothd 开发，并用于分析 iOS 上的各种蓝牙协议。由于它基于 FRIDA 构建，因此可以调整以适配任何运行 FRIDA 的平台。 该仓库还包含一个空中模糊测试器，并给出了一个使用 InternalBlue 对 Apple 的 MagicPairing 协议进行模糊测试的实现示例。此外，还包含了 ReplayCrashFile.py 脚本，可用于验证进程内模糊测试器发现的崩溃。 新增：原地模糊测试器（ToothFlipper）...

OESA-2026-3732 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

bluetoothdPoC

@RaniXCH bluetoothdPoC CVE-2018-4087 PoC ETA 老兄？ （这是越狱吗？） 取决于，你有内核漏洞吗？你可以把它们串在一起。这个漏洞让你在沙盒内拥有巨大的攻击面。 https://www.weibo.com/ttarticle/p/show?id=2309404271293301154324 - @SparkZheng - iOS越狱内部（2）：使用回调逃逸沙盒 参考文献 https://blog.zimperium.com/new-crucial-vulnerabilities-apples-bluetoothd-daemon/...

POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth CVE-2018-4327 的 POC（至少我是这么认为的，因为 @SparkZheng 同时提到了 CVE-2018-4327 和 CVE-2018-4330，但没有说明哪个对应哪个漏洞，但由于他先描述了这一个，所以我猜是这个）。 在 iPhone 6S 11.3.1 上测试通过 应该兼容到 11.4 允许你在 SpringBoard 和少数服务中将 PC（ARM 中 IP 寄存器的版本）设置为你选择的值。 你需要运行代码，然后进入设置中的蓝牙菜单并连接一个设备。如果无效，请关闭并重新打开蓝牙。 利用起来相当烦人，但我喜欢它，所以我想做一个 POC...

toothfairy

toothfairy 与 brokentooth 相关（见下文链接）。 与 brokentooth 不同，toothfairy 无需在蓝牙菜单中按下按钮。 这两个 CVE 均由 @SparkZheng 披露，但未提供 POC，因此我决定为了学习经验制作一个 POC。 代码并非完美，但能够完成工作。 已在 iPhone 6S 11.3.1 上测试 应兼容至 11.4 允许你将 bluetoothd 及其他几个服务上的 PC（ARM 中 IP 寄存器的对应项）设置为你选择的值。 使用了 @raniXCH 的 bluetoothdPoC 代码来处理 Mach 消息的所有准备工作以及向 BT...

UnjailMe

UnjailMe 一个基于以下内容的沙箱逃逸： Rani Idan（Zimperium）的概念验证 CVE-2018-4087 @cheesecakeufo 的 securityd 溢出概念验证（零日漏洞，无已知 CVE，感谢 Abraham！） 关于 ZIMPERIUM PoC Rani 使用了 Jonathan Levine 的 sbtool 来找出沙箱内可通信的服务。 然后他在 bluetoothd 下发现了更多内容，并设置了拦截发送至该服务及来自该服务的消息的代码。 通过这样做，他发现可以劫持许多守护进程的会话，并泄露客户端端口。 由此，他发现可以为客户端到 bluetoothd...

[SECURITY] Fedora 44 Update: bluez-5.87+1.git8750129efca8-1.fc44

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

brokentooth

brokentooth 针对 CVE-2018-4327 的概念验证（至少我认为是，因为 CVE-2018-4327 和 CVE-2018-4330 都由 @SparkZheng 讨论过，但他没有明确说明哪个漏洞对应哪个 bug，鉴于他先描述了前者，我暂且这样猜测）。 已在 iPhone 6S 11.3.1 上测试 理论上适用于 11.4 及之前的版本 允许你在 SpringBoard 及部分服务中将 PC（ARM 上对应 IP 寄存器的版本）设置为你选择的值。你需要先运行代码，然后进入蓝牙设置并连接到一个设备。如果无效，请关闭蓝牙再重新打开。...

CVE-2026-85218

A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation. A nearby BR/EDR peripheral can send a crafted AVRCP player-settings response that supplies an attacker-controlled attribute count, causing avrcplistplayerattributesrsp and avrcpgetcurrentplayervalue in...

[SECURITY] Fedora 43 Update: bluez-5.87-6.fc43

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

Fedora 43 : bluez (2026-d4eec45564)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d4eec45564 advisory. BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP X...

SUSE CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

Fedora 44 : bluez (2026-1fba3f22c9)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1fba3f22c9 advisory. BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP X...

EUVD-2026-66134

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-80186

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-80186 Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

PT-2026-81895

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...