CVE-2023-45866

A flaw was found in the HID Profile in BlueZ that opens doors for unauthorized connections, especially by devices like keyboards, to inject keystrokes without user confirmation. BlueZ lacks proper restrictions on non-bonded devices, creating a risk for attackers that are physically close to inject keystrokes and execute arbitrary commands when the device is in a discoverable state.

Mitigation

Put Bluetooth device in non-discoverable mode / disable incoming pairing.
Or
Disable Bluetooth. Instructions on disabling bluetooth in Red Hat Enterprise Linux are available at: <https://access.redhat.com/solutions/2682931&gt;