An authentication bypass flaw in the Bluetooth protocol allows attackers to connect to vulnerable devices and inject keystrokes.
The issue, tracked as CVE-2023-45866, enables attackers within Bluetooth range to connect to discoverable hosts without user confirmation, warns software engineer Marc Newlin, who found the bug.
The attack, he notes, can be mounted using a Linux machine and a normal Bluetooth adapter.
An adversary can exploit the vulnerability to perform arbitrary actions, assuming those actions do not require a password or biometric authentication.
Newlin initially identified the flaw in macOS and iOS, which are vulnerable even in Lockdown Mode.
He then found similar vulnerabilities in Android and Linux, and discovered that they were a combination of implementation issues and protocol bugs.
According to the engineer, Android devices running OS iterations all the way back for version 4.2.2 are affected, if they have Bluetooth enabled.
Google has included patches for the vulnerability in the December 2023 Android security updates.
Devices running a 2023-12-05 security patch level - available for Android 11 to 14 - are patched against the flaw.
Ubuntu, Debian, Fedora, Gentoo, Arch and Alpine have announced the fix for the flaw, but only ChromeOS has enabled it to date.
MacOS and iOS are also vulnerable, if Bluetooth is enabled and a Magic Keyboard has been paired.
This Cyber News was published on www.securityweek.com. Publication date: Fri, 08 Dec 2023 12:43:04 +0000