CVE-2023-45866 Auth bypass in n/a
Unauthenticated Bluetooth devices can inject HID messages without user authorization, potentially leading to code execution on Linux systems using BlueZ.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45866?
CVE-2023-45866 is a medium-severity authentication bypass vulnerability in Apple Ipados, published on 8 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.
Weakness: CWE-287
Which versions are affected by CVE-2023-45866?
It affects 7 products.
Linux distribution packages (37)
bluez AlmaLinux:8 | All versions | 5.63-3.el8_10.alma.1 |
bluez-cups AlmaLinux:8 | All versions | 5.63-3.el8_10.alma.1 |
bluez-hid2hci AlmaLinux:8 | All versions | 5.63-3.el8_10.alma.1 |
bluez-libs AlmaLinux:8 | All versions | 5.63-3.el8_10.alma.1 |
bluez-libs-devel AlmaLinux:8 | All versions | 5.63-3.el8_10.alma.1 |
bluez-obexd AlmaLinux:8 | All versions | 5.63-3.el8_10.alma.1 |
bluez-cups Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez-cups-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez-hid2hci-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez-libs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez-obexd-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:5.63-3.el8_10 |
bluez Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-cups-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-hid2hci Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-hid2hci-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-libs Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-libs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-obexd Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-obexd-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:5.63-3.el8_10 |
bluez-cups-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez-hid2hci-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez-libs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez-libs-devel Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez-obexd-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:5.63-3.el8_10 |
bluez SUSE:Linux Enterprise Micro 5.3 | All versions | 5.62-150400.4.22.1 |
bluez SUSE:Linux Enterprise Micro 5.4 | All versions | 5.62-150400.4.22.1 |
bluez SUSE:Linux Enterprise Micro 5.5 | All versions | 5.65-150500.3.14.1 |
bluez SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 5.13-5.45.1 |
bluez SUSE:Linux Micro 6.0 | All versions | 5.70-2.1 |
bluez SUSE:Linux Micro 6.1 | All versions | 5.70-slfo.1.1_2.1 |
bluez openSUSE:Tumbleweed | All versions | 5.70-2.1 |
Products include Apple Ipados, Apple Iphone Os, Apple Macos, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora and 1 more.
How do I fix CVE-2023-45866?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-45866 being exploited?
There is no known exploitation of CVE-2023-45866 in the wild and no public exploit code.
Public exploit code: 12 proofs of concept on GitHub.
Other vulnerabilities in Apple Ipados
- CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write
- CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write
- CVE-2025-24085 Apple Multiple Products Use-After-Free
- CVE-2025-31200 Apple Multiple Products Memory Corruption
- CVE-2025-31201 Apple Multiple Products Arbitrary Read and Write
Sources
Also known as A-294854926, ALSA-2024:11154, ASB-A-294854926, AZL-32161, AZL-34571, BELL-CVE-2023-45866 and 15 more.