Bugzilla – Bug 1188859
VUL-0: CVE-2021-3658: bluez: adapter incorrectly restores Discoverable state after powered down
Last modified: 2022-11-15 14:32:21 UTC
rh#1984728 bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically proximate attackers. References: https://bugzilla.redhat.com/show_bug.cgi?id=1984728 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3658
Upstream commit: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8 Here's the current code stream status: SUSE:SLE-11-SP3:Update Not affected SUSE:SLE-12-SP2:Update Affected SUSE:SLE-15:Update Affected SUSE:SLE-15-SP2:Update Affected SUSE:SLE-15-SP3:Update Affected SUSE:SLE-15-SP4:Update Already fixed References: https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89
SUSE-SU-2022:3687-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 1186463,1188859,1192394,1193227,1193237 CVE References: CVE-2019-8921,CVE-2019-8922,CVE-2020-26558,CVE-2021-0129,CVE-2021-3658,CVE-2021-43400 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise Server for SAP 15 (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise Server 15-LTSS (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): bluez-5.48-150000.5.41.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): bluez-5.48-150000.5.41.1 SUSE Enterprise Storage 6 (src): bluez-5.48-150000.5.41.1 SUSE CaaS Platform 4.0 (src): bluez-5.48-150000.5.41.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3691-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 1186463,1188859,1192394,1193227,1193237 CVE References: CVE-2019-8921,CVE-2019-8922,CVE-2020-26558,CVE-2021-0129,CVE-2021-3658,CVE-2021-43400 JIRA References: Sources used: SUSE Manager Server 4.1 (src): bluez-5.48-150200.13.17.1 SUSE Manager Retail Branch Server 4.1 (src): bluez-5.48-150200.13.17.1 SUSE Manager Proxy 4.1 (src): bluez-5.48-150200.13.17.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): bluez-5.48-150200.13.17.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): bluez-5.48-150200.13.17.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): bluez-5.48-150200.13.17.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): bluez-5.48-150200.13.17.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): bluez-5.48-150200.13.17.1 SUSE Enterprise Storage 7 (src): bluez-5.48-150200.13.17.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3981-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1188859,1192394 CVE References: CVE-2021-3658,CVE-2021-43400 JIRA References: Sources used: openSUSE Leap 15.3 (src): bluez-5.55-150300.3.14.1 SUSE Linux Enterprise Workstation Extension 15-SP3 (src): bluez-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): bluez-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): bluez-5.55-150300.3.14.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.