bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

An update of the bluez package has been released.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Authvalue leak in Bluetooth Mesh Provisioning (CVE-2020-26559)

  - bluez: BlueZ allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c (CVE-2022-39177)

  - Pairing in Bluetooth Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials     with two pairing devices via adjacent access when the unauthenticated user initiates different pairing     methods in each peer device and an end-user erroneously completes both pairing procedures with the MITM     using the confirmation number of one peer as the passkey of the other. An adjacent, unauthenticated     attacker could be able to initiate any Bluetooth operation on either attacked device exposed by the     enabled Bluetooth profiles. This exposure may be limited when the user must authorize certain access     explicitly, but so long as a user assumes that it is the intended remote device requesting permissions,     device-local protections may be weakened. (CVE-2020-10134)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3981-1 advisory.

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3687-1 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3691-1 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bluez package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.04 / 21.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5155-1 advisory.

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

  - bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and     restores it when powered up. If a device is powered down while discoverable, it will be discoverable when     powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby     attackers. (CVE-2021-3658)

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203913	Photon OS 3.0: Bluez PHSA-2022-3.0-0374	Nessus	PhotonOS Local Security Checks	medium
203308	Photon OS 4.0: Bluez PHSA-2022-4.0-0163	Nessus	PhotonOS Local Security Checks	medium
198738	RHEL 8 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
167726	SUSE SLED15 / SLES15 Security Update : bluez (SUSE-SU-2022:3981-1)	Nessus	SuSE Local Security Checks	critical
166424	SUSE SLES15 Security Update : bluez (SUSE-SU-2022:3687-1)	Nessus	SuSE Local Security Checks	critical
166417	SUSE SLES15 Security Update : bluez (SUSE-SU-2022:3691-1)	Nessus	SuSE Local Security Checks	critical
158405	EulerOS 2.0 SP10 : bluez (EulerOS-SA-2022-1200)	Nessus	Huawei Local Security Checks	medium
158379	EulerOS 2.0 SP10 : bluez (EulerOS-SA-2022-1219)	Nessus	Huawei Local Security Checks	medium
155687	Ubuntu 18.04 LTS / 20.04 LTS : BlueZ vulnerabilities (USN-5155-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2021-3658

medium

Tenable Plugins

medium

medium

high

critical

critical

critical

medium

medium

critical