CVE-2021-3658: Medium severity BlueZ BlueZ vulnerability
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically proximate attackers.
Other sources
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3658?
CVE-2021-3658 is a vulnerability in bluetoothd from bluez that incorrectly saves adapters' Discoverable status when a device is powered down and restores it when powered up, potentially exposing the bluetooth stack to physical attacks.
What is the severity of CVE-2021-3658?
The severity of CVE-2021-3658 is medium with a CVSS score of 6.5.
Which software is affected by CVE-2021-3658?
BlueZ versions up to 5.61 and Fedora 34 are affected by CVE-2021-3658.
How can CVE-2021-3658 be fixed?
To fix CVE-2021-3658, users should update their BlueZ software to a version beyond 5.61 or update Fedora to a version beyond 34, once patches are available.
Where can I find more information about CVE-2021-3658?
More information about CVE-2021-3658 can be found in the following references: [https://access.redhat.com/security/cve/CVE-2018-10910](https://access.redhat.com/security/cve/CVE-2018-10910), [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1606203](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1606203), [https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8](https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8).