PT-2021-14449 · Elementary Os · Switchboard Bluetooth Plug

Davidmhewitt · Published 2021-03-12 · Updated 2024-11-12 · CVE-2021-21367

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Switchboard Bluetooth Plug for elementary OS versions 2.3.0 through 2.3.5

Description The issue allows physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent of the user, potentially extracting data from installed services or controlling the device. By default, elementary OS doesn't expose services that allow information extraction via Bluetooth, but installed services like contact list sharing software may be vulnerable. Attackers may also play audio or present a HID device to control the device. Users should check and remove unconfirmed paired devices.

Recommendations For versions prior to 2.3.5, to mitigate the risk entirely, do not open the Bluetooth plug within switchboard at all, and use a different method for pairing devices if necessary, such as the bluetoothctl CLI. To reduce the likelihood of this issue on unpatched versions, only open the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public areas. For the best resolution, update to version 2.3.5 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-21367

GHSA-5P3G-J69G-W2MQ

OPENSUSE-SU-2024:14486-1

Affected Products

Switchboard Bluetooth Plug

References · 15

• https://github.com/elementary/switchboard-plug-bluetooth/commit/86500e645a907538abafe5225b67cc12c03e7645 · Patch
• https://github.com/elementary/switchboard-plug-bluetooth/security/advisories/GHSA-5p3g-j69g-w2mq · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21367 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21367 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV7WKO5SZHTF3QEMX4WZ576HRECIG6VQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7TCGM4B45VLUJDCE5PHFYA5KBNHD4RA · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14486-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWUPPVFG76PXQA3AHSGKYPRMVZ5AYHZI · Vendor Advisory
• https://github.com/elementary/switchboard-plug-bluetooth/releases/tag/2.3.5 · Note
• https://t.me/cvenotify/11807 · Telegram Post
• https://t.me/cvenotify/11267 · Telegram Post
• https://suse.com/security/cve/CVE-2021-21367 · Note
• https://t.me/cvenotify/11506 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/YFGQCR2WYDLBNNHUD2VKSHBVPR73NKUE · Note
• https://t.me/cvenotify/11465 · Telegram Post