Vulnerability · Published Mar 12, 2021 · Assigned by GitHub_M
CVE-2021-21367Incorrect Authorization in switchboard-plug-bluetooth
Medium 6.1
In plain English
A medium-severity incorrect authorization in switchboard-plug-bluetooth from elementary. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list sharing software) have been installed, it's possible that attackers have been able to extract data from such services without authorization. If no such services have been installed, attackers are only able to pair with a device running an affected version without authorization and then play audio out of the device or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| elementary | switchboard-plug-bluetooth | >= 2.3.0, < 2.3.5 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
References
- https://github.com/elementary/switchboard-plug-bluetooth/security/advisories/GHSA-5p3g-j69g-w2mq x_refsource_CONFIRM
- https://github.com/elementary/switchboard-plug-bluetooth/releases/tag/2.3.5 x_refsource_MISC
- https://github.com/elementary/switchboard-plug-bluetooth/commit/86500e645a907538abafe5225b67cc12c03e7645 x_refsource_MISC
- FEDORA-2021-3dedd41a06 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-7d55c00267 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-6210be0100 vendor-advisory, x_refsource_FEDORA