CVE-2021-3658

NameCVE-2021-3658
Descriptionbluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs991596

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bluez (PTS)buster5.50-1.2~deb10u2fixed
buster (security)5.50-1.2~deb10u4fixed
bullseye (security), bullseye5.55-3.1+deb11u1vulnerable (unimportant)
bookworm, bookworm (security)5.66-1+deb12u1fixed
sid, trixie5.71-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bluezsourcestretch(not affected)
bluezsourcebuster(not affected)
bluezsource(unstable)5.61-1991596

Notes

[bullseye] - bluez <no-dsa> (Minor issue)
[buster] - bluez <not-affected> (Vulnerable code introduced later)
[stretch] - bluez <not-affected> (Vulnerable code introduced later)
Introduced by https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=d04eb02f9bad8795297210ef80e262be16ea8f07 (5.51)
Fixed by https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055

Search for package or bug name: Reporting problems