CVE-2021-3658

Name
CVE-2021-3658
Description
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Issue Tracking https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89
Patch https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1984728
Patch https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055
CONFIRM https://security.netapp.com/advisory/ntap-20220407-0002/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:bluez:bluez:*:*:*:*:*:*:*:* bluez >= None < 5.61

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
bluez 3.14-main 5.58-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
bluez 3.13-main 5.55-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
bluez 3.12-main 5.54-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable