CVE-2021-3658 in BlueZ
Summary
by MITRE • 03/03/2022
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/16/2026
The vulnerability identified as CVE-2021-3658 resides within the bluetoothd component of the BlueZ Bluetooth protocol stack, representing a critical security flaw that affects the proper management of Bluetooth adapter states during power cycles. This issue specifically impacts how the system handles the discoverable status of Bluetooth adapters, creating a persistent security risk that can be exploited by attackers with physical proximity to affected devices. The flaw demonstrates a fundamental failure in state persistence management where the system does not properly reset or validate the discoverable flag when transitioning from powered-off to powered-on states.
The technical implementation of this vulnerability stems from improper state handling logic within the bluetoothd daemon, which fails to correctly reset the discoverable status flag when a Bluetooth adapter is powered down. When a device is powered off while in discoverable mode, the system incorrectly preserves this state information in persistent storage or configuration files. Upon subsequent power-on events, the system retrieves this stored discoverable flag and re-enables the discoverable mode without proper validation or security checks. This behavior violates the expected security boundaries and creates an unintended attack surface that can be leveraged by malicious actors.
From an operational perspective, this vulnerability creates a significant risk for any device running BlueZ versions that contain this flaw, particularly affecting mobile devices, laptops, tablets, and IoT devices that rely on Bluetooth connectivity. The impact extends beyond simple privacy concerns to potentially enable various attack vectors including unauthorized device pairing, data interception, and service enumeration. Attackers with physical access to devices can exploit this vulnerability to gain persistent access to Bluetooth services, potentially leading to more severe consequences such as remote code execution or lateral movement within network environments. The vulnerability is particularly concerning because it operates at the system level and can affect devices that are not actively in use, creating a window of opportunity for attackers.
The security implications of CVE-2021-3658 align with CWE-665 improper initialization and can be categorized under ATT&CK technique T1046 network service scanning and T1059 command and scripting interpreter. This vulnerability represents a failure in secure configuration management and demonstrates the importance of proper state validation during system transitions. The flaw can be exploited as part of broader attack chains where attackers first establish physical presence to trigger the vulnerability, then leverage the unintended discoverable state to perform reconnaissance and establish persistent access points. Organizations should consider this vulnerability as part of their broader Bluetooth security posture assessment and implement comprehensive monitoring for unauthorized Bluetooth activity.
Mitigation strategies should focus on immediate patching of affected BlueZ versions, implementation of proper Bluetooth adapter state management policies, and deployment of network monitoring solutions to detect anomalous Bluetooth activity. System administrators should disable Bluetooth discoverable mode by default and implement automated checks to ensure that Bluetooth adapters reset to secure states upon power cycling. The vulnerability underscores the necessity of proper security testing for state management functions and highlights the importance of validating system behavior during power transition events. Organizations should also consider implementing Bluetooth device whitelisting mechanisms and establishing clear policies for Bluetooth usage in sensitive environments to prevent exploitation of this and similar vulnerabilities.