The Patching Friars' AlmanacA calendar of CVE saints

July 10

PerfektBlueHoly card for perfektblue, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 PerfektBlue PER RADIOPHONUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint PerfektBlue, Who Entered Through the Car Stereo

Patron of Bluetooth stacks, infotainment systems, and those who pair with headphones without a thought.

Life

In 2025 Mikhail Evdokimov and colleagues at PCA Cyber Security revealed PerfektBlue, a chain of four flaws in OpenSynergy's BlueSDK, the Bluetooth stack of many infotainment systems (Mercedes-Benz, Volkswagen, Skoda). Once paired, with at most one click from the victim, a nearby attacker could run code on the unit, a foot inside the car from which to reach for more critical functions. Bluetooth, born for convenience, became the way in.

Prayer

O Saint PerfektBlue, who enters through the car stereo and takes a seat in the cabin, let our stacks ask permission before they execute. Amen.

How to celebrate

Celebrated by updating the infotainment firmware and keeping the car's Bluetooth off when it is not needed.

Who pairs with all hosts anyone.

Technical record

Disclosed on
July 10 2025
CVE
CVE-2024-45431CVE-2024-45432CVE-2024-45433CVE-2024-45434
CVSS
9.8

OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID (CID). An attacker can leverage this to create an L2CAP channel with the null identifier assigned as a remote CID.

Sources: perfektblue.pcacybersecurity.com · pcacybersecurity.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.