An authentication bypass flaw in the Bluetooth protocol allows attackers to connect to vulnerable devices and inject keystrokes.
The issue, tracked as CVE-2023-45866, enables attackers within Bluetooth range to connect to discoverable hosts without user confirmation, warns software engineer Marc Newlin, who found the bug.
“A nearby attacker can connect to a vulnerable device over unauthenticated Bluetooth and inject keystrokes to eg. install apps, run arbitrary commands, forward messages, etc.,” Newlin explains.
The attack, he notes, can be mounted using a Linux machine and a normal Bluetooth adapter. An adversary can exploit the vulnerability to perform arbitrary actions, assuming those actions do not require a password or biometric authentication.
Newlin initially identified the flaw in macOS and iOS, which are vulnerable even in Lockdown Mode. He then found similar vulnerabilities in Android and Linux, and discovered that they were a combination of implementation issues and protocol bugs.
“The vulnerabilities work by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user-confirmation. The underlying unauthenticated pairing mechanism is defined in the Bluetooth specification, and implementation-specific bugs expose it to the attacker,” Newlin says.
According to the engineer, Android devices running OS iterations all the way back for version 4.2.2 are affected, if they have Bluetooth enabled.
Google has included patches for the vulnerability in the December 2023 Android security updates. Devices running a 2023-12-05 security patch level – available for Android 11 to 14 – are patched against the flaw.
Linux devices with Bluetooth set to “discoverable/connectable” are impacted as well. Although the issue was addressed in the platform in 2020, as CVE-2020-0556, “the fix was left disabled by default,” Newlin notes.
Ubuntu, Debian, Fedora, Gentoo, Arch and Alpine have announced the fix for the flaw, but only ChromeOS has enabled it to date.
macOS and iOS are also vulnerable, if Bluetooth is enabled and a Magic Keyboard has been paired. “Lockdown Mode does not prevent the attack,” Newlin says.
Related: New BLUFFS Bluetooth Attack Methods Can Have Large-Scale Impact: Researcher
Related: Google Patches Critical Android Flaw Allowing Remote Code Execution via Bluetooth
Related: Researchers Devise New Type of Bluetooth LE Relay Attacks
