Lucene search

K
osvGoogleOSV:USN-6540-1
HistoryDec 07, 2023 - 4:07 a.m.

bluez vulnerability

2023-12-0704:07:20
Google
osv.dev
2
bluez
vulnerability
hid event injection
non-bonded devices
input subsystem
physically proximate attacker
keystrokes
arbitrary commands
discoverable

6.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.5%

It was discovered that BlueZ did not properly restrict non-bonded devices
from injecting HID events into the input subsystem. This could allow a
physically proximate attacker to inject keystrokes and execute arbitrary
commands whilst the device is discoverable.

6.3 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.5%