Medium
Security advisory
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-3658
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:37 UTC · Revision 1
Source evidence
bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.
osv:CVE-2021-3658
Complete source record
{
"id": "735a484517eb461019781b9f8ba33761b22365cea93c5dc28a8ca6be274413ee",
"url": "https://osv.dev/vulnerability/CVE-2021-3658",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-3658",
"summary": "bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.",
"evidence": "osv:CVE-2021-3658",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-3658",
"aliases": [
"CVE-2021-3658"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/bluez/bluez",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d61f9dc54c04f4fc5791398a0dbae59d671846bf"
},
{
"fixed": "b497b5942a8beb8f89ca1c359c54ad67ec843055"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:bluez:bluez:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.61"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "b497b5942a8beb8f89ca1c359c54ad67ec843055"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"5.60",
"5.59",
"5.58",
"5.57",
"5.56",
"5.55",
"5.54",
"5.53",
"5.52",
"5.51",
"5.50",
"5.49",
"5.48",
"5.47",
"5.46",
"5.45",
"5.44",
"5.43",
"5.42",
"5.41",
"5.40",
"5.39",
"5.38",
"5.37",
"5.36",
"5.35",
"5.34",
"5.33",
"5.32",
"5.31",
"5.30",
"5.29",
"5.28",
"5.27",
"5.26",
"5.25",
"5.24",
"5.23",
"5.22",
"5.21",
"5.20",
"5.19",
"5.18",
"5.17",
"5.16",
"5.15",
"5.14",
"5.13",
"5.12",
"5.11",
"5.10",
"5.9",
"5.8",
"5.7",
"5.6",
"5.5",
"5.4",
"5.3",
"5.2",
"5.1",
"5.0",
"4.101",
"4.100",
"4.99",
"4.98",
"4.97",
"4.96",
"4.95",
"4.94",
"4.93",
"4.92",
"4.91",
"4.90",
"4.89",
"4.88",
"4.87",
"4.86",
"4.85",
"4.84",
"4.83",
"4.82",
"4.81",
"4.80",
"4.79",
"4.78",
"4.77",
"4.76",
"4.75",
"4.74",
"4.73",
"4.72",
"4.71",
"4.70",
"4.69",
"4.68",
"4.67",
"4.66",
"4.65",
"4.64",
"4.63",
"4.62",
"4.61",
"4.60",
"4.59",
"4.58",
"4.57",
"4.56",
"4.55",
"4.54",
"4.53",
"4.52",
"4.51",
"4.50",
"4.49",
"4.48",
"4.47",
"4.46",
"4.45",
"4.44",
"4.43",
"4.42",
"4.41",
"4.40",
"4.39",
"4.38",
"4.37",
"4.36",
"4.35",
"4.34",
"4.33",
"4.32",
"4.31",
"4.30",
"4.29",
"4.28",
"4.27",
"4.26",
"4.25",
"4.24",
"4.23",
"4.22",
"4.21",
"4.20",
"4.19",
"4.18",
"4.17",
"4.16",
"4.15",
"4.14",
"4.13",
"4.12",
"4.11",
"4.10",
"4.9",
"4.8",
"4.7",
"4.6",
"4.5",
"4.2",
"4.1",
"4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3658.json",
"vanir_signatures": [
{
"id": "CVE-2021-3658-0c766298",
"digest": {
"length": 1061,
"function_hash": "172027338237442028981457552073053210895"
},
"source": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055",
"target": {
"file": "src/adapter.c",
"function": "settings_changed"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3658-1b478c07",
"digest": {
"length": 658,
"function_hash": "199595814707437147550770859530159079118"
},
"source": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055",
"target": {
"file": "src/adapter.c",
"function": "discovery_stop"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3658-255cac33",
"digest": {
"length": 884,
"function_hash": "57237209113128885327700725533408695124"
},
"source": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055",
"target": {
"file": "src/adapter.c",
"function": "adapter_stop"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3658-297e66dd",
"digest": {
"length": 798,
"function_hash": "215979409219665248096667193507816966873"
},
"source": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055",
"target": {
"file": "src/adapter.c",
"function": "update_discovery_filter"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3658-7a00089e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"104963158307056949970478967016227532226",
"8317727962398119407694419342329404763",
"175054941858700326123829779280039261289",
"251423948320023549285677037730184888090",
"12383206230189842888959702628075866467",
"20390998104180392456583877290186598934",
"293449557786167649077905277248810166294",
"279746179832303866084162767381354546838",
"6132234258970871568308376810271159734",
"125370935030374927247098034432961599817",
"93995179838233683689132522363768980786",
"143542901489466510333381450696622781082",
"321803935910930282280658943519637646925",
"182699486257270206849675125404156334454",
"74093005512484253079730087572995644321",
"29381542872701219824715949462673746146",
"12382800406218439269835812647535154854",
"120146882866845834554881232910048718501",
"318224308502749218959302652079401459729",
"170924521707944439506502293211221553803",
"106877442399903015343127233090525467813",
"73553654635103188591430240571473489102",
"191387600899533796202078086118715612356",
"286395407552482058087899055423815776317",
"298862074986819470553649304418046728791",
"96002444711225654149319199652217768750",
"327020276478737271472315511011154976805"
]
},
"source": "https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055",
"target": {
"file": "src/adapter.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:04:49Z"
}
}
],
"modified": "2026-10-20T14:04:49.492677526Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html",
"https://security.netapp.com/advisory/ntap-20220407-0002/",
"https://bugzilla.redhat.com/show_bug.cgi?id=1984728",
"https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055",
"https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055",
"https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "34"
},
{
"last_affected": "34"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-3658",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388536,
"published_at": "2022-03-02T23:15:08.787+00:00"
}