Vulnerability CVE-2021-3658

Vulnerability Name:

CVE-2021-3658 (CCN-213318)

Assigned:

2021-07-26

Published:

2021-07-26

Updated:

2022-06-03

Summary:

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

4.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
4.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

3.3 Low (CVSS v2 Vector: AV:A/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:A/AC:H/Au:S/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): High Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-863

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2021-3658

Source: CCN
Type: Red Hat Bugzilla Bug 1984728
(CVE-2021-3658) - CVE-2021-3658 bluez: adapter incorrectly restores Discoverable state after powered down

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1984728

Source: XF
Type: UNKNOWN
bluez-cve20213658-sec-bypass(213318)

Source: CCN
Type: BlueZ GIT Repository
adapter: Fix storing discoverable setting

Source: MISC
Type: Patch, Third Party Advisory
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220407-0002/

Vulnerable Configuration:

Configuration 1:

cpe:/a:bluez:bluez:*:*:*:*:*:*:*:* (Version < 5.61)

Configuration 2:

cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:bluez:bluez:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK