PT-2021-7330 · Bluez+5 · Bluez+5

Vudentz · Published 2021-06-24 · Updated 2024-09-07 · CVE-2021-3658

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlueZ (affected versions not specified)

Description The issue is related to the incorrect saving of the Discoverable status of Bluetooth adapters when a device is powered down, which is then restored when the device is powered on again. If a device is powered down while in a discoverable state, it will remain discoverable when powered on, potentially exposing the Bluetooth stack to nearby attackers. This could lead to the inadvertent exposure of confidential data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2021-2665

ALT-PU-2021-3492

BDU:2022-05703

CVE-2021-3658

DLA-3879-1

MGASA-2021-0395

OESA-2021-1370

OPENSUSE-SU-2022_3981-1

SUSE-SU-2022:3687-1

SUSE-SU-2022:3691-1

SUSE-SU-2022:3981-1

SUSE-SU-2022_3981-1

USN-5155-1

Affected Products

Alt Linux

Astra Linux

Bluez

Linuxmint

Suse

Ubuntu

References · 47

• https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055 · Patch
• https://advisories.mageia.org/MGASA-2021-0395.html · Security Note
• https://osv.dev/vulnerability/OESA-2021-1370 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3658 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3658 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3879-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5155-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3981-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41229 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3658 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3691-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3658 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3658 · Vendor Advisory
• https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055 · Patch