CVE-2021-21367

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2021-21367
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-03-12 17:15:00 UTC
Updated2023-11-07 03:29:00 UTC
DescriptionSwitchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list sharing software) have been installed, it's possible that attackers have been able to extract data from such services without authorization. If no such services have been installed, attackers are only able to pair with a device running an affected version without authorization and then play audio out of the device or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI).

Risk And Classification

Problem Types: CWE-863

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Elementary Switchboard Bluetooth Plug All All All All
Operating System Fedoraproject Fedora 32 All All All
Operating System Fedoraproject Fedora 33 All All All

References

ReferenceSourceLinkTags
[SECURITY] Fedora 32 Update: switchboard-plug-bluetooth-2.3.5-1.fc32 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[SECURITY] Fedora 32 Update: switchboard-plug-bluetooth-2.3.5-1.fc32 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 33 Update: switchboard-plug-bluetooth-2.3.5-1.fc33 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 34 Update: switchboard-plug-bluetooth-2.3.5-1.fc34 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
[SECURITY] Fedora 33 Update: switchboard-plug-bluetooth-2.3.5-1.fc33 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
Merge pull request from GHSA-5p3g-j69g-w2mq · elementary/switchboard-plug-bluetooth@86500e6 · GitHub MISC github.com
Incorrect Authorization in switchboard-plug-bluetooth · Advisory · elementary/switchboard-plug-bluetooth · GitHub CONFIRM github.com
Release switchboard-plug-bluetooth 2.3.5 Released · elementary/switchboard-plug-bluetooth · GitHub MISC github.com
[SECURITY] Fedora 34 Update: switchboard-plug-bluetooth-2.3.5-1.fc34 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 281515 Fedora Security Update for switchboard (FEDORA-2021-7d55c00267)
  • 281516 Fedora Security Update for switchboard (FEDORA-2021-3dedd41a06)
  • 281517 Fedora Security Update for switchboard (FEDORA-2021-6210be0100)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report