It was discovered that the HID and HOGP profiles implementations in bluez before 5.54 don't specifically require bonding between the device and the host. This creates an opportunity for a malicious device to connect to a target host to either impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem froma non-bonded source. This potentially enables escalation of privilege and denial of service via adjacent access.
It was discovered that the HID and HOGP profiles implementations in bluez before 5.54 don't specifically require bonding between the device and the host. This creates an opportunity for a malicious device to connect to a target host to either impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem froma non-bonded source. This potentially enables escalation of privilege and denial of service via adjacent access.
https://lore.kernel.org/linux-bluetooth/20200310023516.209146-1-alainm@chromium.org/ https://patchwork.kernel.org/patch/11428317/ https://patchwork.kernel.org/patch/11428319/ https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=8cdbd3b09f29da29374e2f83369df24228da0ad1 https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=3cccdbab2324086588df4ccf5f892fb3ce1f1787
Vulmon