CVE-2024-8805

What it actually does

The flaw is an improper access control issue in the HID over GATT Profile implementation that allows unauthenticated network-adjacent attackers to invoke privileged functionality and achieve remote code execution in the context of the current user.

Why it matters to the business

Successful exploitation can lead to full compromise of Bluetooth-enabled systems, enabling attackers to run malicious code, steal data, or pivot within the environment; the vulnerability affects widely used Bluetooth stacks with high ecosystem prevalence.

How an attack unfolds

An attacker within Bluetooth range connects to a vulnerable device, bypasses missing authorization checks in the HID over GATT Profile, and supplies crafted input to execute arbitrary code; while not currently observed in widespread campaigns, similar zero-day exploitation patterns by espionage and financially motivated actors have been noted in 2024.

How to fix it

Upgrade affected packages to the fixed versions provided by the distributor; for the listed qemu package on Ubuntu 14.04 LTS apply 2.0.0+dfsg-2ubuntu1.26 or later. Where immediate patching is not possible, disable unnecessary Bluetooth services and enforce network segmentation to limit adjacent access.

How to confirm the fix worked

Verify the installed package version matches or exceeds the fixed release, confirm the vulnerable HID over GATT code paths are no longer present after the update, and test that Bluetooth pairing still functions for authorized devices.

Typical attack path

1. Locate a Bluetooth-adjacent target running an affected BlueZ installation
2. Establish a GATT connection without authentication
3. Send specially crafted HID reports that abuse the missing authorization checks
4. Achieve code execution in the context of the current user process

How to detect it

Review Bluetooth daemon logs and system audit trails for unexpected GATT connections or HID profile activity from unknown devices; look for process anomalies or crashes in bluetoothd around the time of suspicious pairing attempts.

What your security team should do

• Prioritize patching systems exposing Bluetooth interfaces within the next 30 days given the network-adjacent attack vector
• Inventory all BlueZ and dependent qemu deployments to identify exposure
• Apply the exact fixed package version 2.0.0+dfsg-2ubuntu1.26 where applicable
• Monitor EPSS trend and threat actor reports for any increase in exploitation activity