CVE-2024-8805: BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the HID over GATT Profile. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25177.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8805?
CVE-2024-8805 has a critical severity due to the potential for remote code execution without authentication.
How do I fix CVE-2024-8805?
To mitigate CVE-2024-8805, it is recommended to update BlueZ to version 5.78 or later where the vulnerability is patched.
What types of attacks can be carried out using CVE-2024-8805?
Exploitation of CVE-2024-8805 allows attackers to execute arbitrary code, potentially compromising the system.
Who is affected by CVE-2024-8805?
CVE-2024-8805 affects installations of BlueZ version 5.77, specifically those using the HID over GATT Profile.
Is authentication required to exploit CVE-2024-8805?
Authentication is not required to exploit CVE-2024-8805, making it particularly dangerous.