CVE-2021-3658

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

• CWE-863
• CWE-863

• https://bugzilla.redhat.com/show_bug.cgi?id=1984728Issue Tracking, Patch, Third Party Advisory
• https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055Patch, Third Party Advisory
• https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055Patch, Third Party Advisory
• https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89Issue Tracking, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220407-0002/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1984728Issue Tracking, Patch, Third Party Advisory
• https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=b497b5942a8beb8f89ca1c359c54ad67ec843055Patch, Third Party Advisory
• https://github.com/bluez/bluez/commit/b497b5942a8beb8f89ca1c359c54ad67ec843055Patch, Third Party Advisory
• https://gitlab.gnome.org/GNOME/gnome-bluetooth/-/issues/89Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html
• https://security.netapp.com/advisory/ntap-20220407-0002/Third Party Advisory

Published

Mar 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36568In certain Moodle products after creating a course, it is po…5.4
• CVE-2021-36569Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 …8.8
• CVE-2021-3657A flaw was found in mbsync versions prior to 1.4.4. Due to i…9.8
• CVE-2021-36570Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 …8.8
• CVE-2021-36572Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2…6.1
• CVE-2021-36573File Upload vulnerability in Feehi CMS thru 2.1.1 allows att…5.4
• CVE-2021-36580Open Redirect vulnerability exists in IceWarp MailServer Ice…6.1
• CVE-2021-36581Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It…9.8
• CVE-2021-36582In Kooboo CMS 2.1.1.0, it is possible to upload a remote she…9.8
• CVE-2021-36584An issue was discovered in GPAC 1.0.1. There is a heap-based…5.5
• CVE-2021-3659A NULL pointer dereference flaw was found in the Linux kerne…5.5
• CVE-2021-36593Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…