Ubuntu 23.10 USN-6540-1 Critical: BlueZ Input Control Threat

ubuntu

December 7, 2023

BlueZ could be made to give a physically proximate attacker keyboard and mouse control of a computer.

Summary

BlueZ could be made to give a physically proximate attacker keyboard and

mouse control of a computer.

Software Description:

- bluez: Bluetooth tools and daemons

Details:

It was discovered that BlueZ did not properly restrict non-bonded devices

from injecting HID events into the input subsystem. This could allow a

physically proximate attacker to inject keystrokes and execute arbitrary

commands whilst the device is discoverable.

Topics Covered

security advisory critical Ubuntu attack BlueZ input control

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   bluez                           5.68-0ubuntu1.1
   libbluetooth3                   5.68-0ubuntu1.1

Ubuntu 23.04:
   bluez                           5.66-0ubuntu1.1
   libbluetooth3                   5.66-0ubuntu1.1

Ubuntu 22.04 LTS:
   bluez                           5.64-0ubuntu1.1
   libbluetooth3                   5.64-0ubuntu1.1

Ubuntu 20.04 LTS:
   bluez                           5.53-0ubuntu3.7
   libbluetooth3                   5.53-0ubuntu3.7

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   bluez                           5.48-0ubuntu3.9+esm1
   libbluetooth3                   5.48-0ubuntu3.9+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   bluez                           5.37-0ubuntu5.3+esm3
   libbluetooth3                   5.37-0ubuntu5.3+esm3

In general, a standard system update will make all the necessary changes.