CVE-2021-3658

What it actually does

The bluetoothd daemon in BlueZ persists the Discoverable adapter flag across power cycles instead of resetting it, causing an adapter powered down while discoverable to restore that state on power-up and remain visible to nearby Bluetooth radios.

Why it matters to the business

Bluetooth-enabled devices can unintentionally expose their radio stack to physical-proximity attackers after routine restarts, raising the chance of unauthorized access or information disclosure without any user-visible change in settings.

How an attack unfolds

An attacker within Bluetooth range continuously scans for discoverable devices; when a target system is powered on after having been discoverable at shutdown, the restored flag makes the adapter visible, allowing the attacker to attempt pairing, connection, or further Bluetooth stack interaction.

How to fix it

Upgrade bluez to the commit d61f9dc54c04f4fc5791398a0dbae59d671846bf or later; after updating, verify that Discoverable state is not restored across power cycles and consider disabling discoverability by default in adapter configuration.

How to confirm the fix worked

Confirm the installed BlueZ version contains commit d61f9dc54c04f4fc5791398a0dbae59d671846bf; test by setting an adapter discoverable, powering the system off and on, then checking that the flag is cleared on restart.

Typical attack path

1. Perform Bluetooth inquiry scans from a nearby location
2. Detect adapters that become discoverable after power-on without user intent
3. Initiate pairing or SDP queries against the exposed adapter
4. Leverage any subsequent Bluetooth vulnerabilities or services for data access

How to detect it

Review system logs for bluetoothd messages indicating adapter power state changes paired with persistent discoverable flags; correlate with unexpected SDP or inquiry responses observed on the network or via Bluetooth monitoring tools.

What your security team should do

• Apply the fixed BlueZ commit to all affected systems as soon as possible
• Audit Bluetooth adapter configurations to enforce non-discoverable defaults
• Monitor logs for unexpected changes to adapter discoverable state
• Disable Bluetooth entirely on systems where it is not required