CVE-2021-3658

MEDIUM

bluez < 5.61 - Incorrect Authorization via Discoverable Status Persistence

Title source: llm
STIX 2.1

Description

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

References (6)

Core 6
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1984728
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220407-0002/

Scores

CVSS v3 6.5
EPSS 0.0007
EPSS Percentile 22.1%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (3)
None/bluez Fixedin - 5.61 and above.
bluez/bluez < 5.61
fedoraproject/fedora 34
Published Mar 02, 2022
Tracked Since Feb 18, 2026