[ GLSA 202003-49 ] BlueZ

[GLSA]

Gentoo Linux Security Advisory

Title: BlueZ: Security bypass (GLSA 202003-49)
Severity: high
Exploitable: remote
Date: 2020-03-25
Bug(s): #712292
ID: 202003-49

Synopsis

A vulnerability in BlueZ might allow remote attackers to bypass
security restrictions.


Background

Set of tools to manage Bluetooth devices for Linux.

Affected Packages

Package: net-wireless/bluez
Vulnerable: < 5.54
Unaffected: >= 5.54
Architectures: All supported architectures


Description

It was discovered that the HID and HOGP profiles implementations in
BlueZ did not specifically require bonding between the device and the
host.


Impact

A remote attacker with adjacent access could impersonate an existing HID
device, cause a Denial of Service condition or escalate privileges.


Workaround

There is no known workaround at this time.

Resolution

All BlueZ users should upgrade to the latest version: