Fix the security vulnerability issue 47/302047/1 accepted/tizen_6.5_unified tizen_6.5 accepted/tizen/6.5/unified/20231207.042856
authorWootak Jung <wootak.jung@samsung.com>
Tue, 28 Nov 2023 05:51:49 +0000 (14:51 +0900)
committerWootak Jung <wootak.jung@samsung.com>
Thu, 30 Nov 2023 04:44:24 +0000 (13:44 +0900)
commit4a334665c3316ae212d7cee5970169753c0af39e
tree79f1de10b18b8b2353d159bfb74a7ef744c235e9
parent11b1de93b1baaa9af62a59249aa532a76049101b
Fix the security vulnerability issue

A variant of this attack works when bluetoothctl shows that bluetooth is
discoverable, pariable, and discovering (only a subset may be necessary). On
Ubuntu 22.04 Desktop this becomes true when the GNOME panel for
bluetooth settings is opened.

BlueZ's setting ClassicBondedOnly=true prevents this attack.
This parameter is not enabled in CVE-2020-0556 patches and all distros
I checked have not opted into this setting. Most members of the distros list
are likely affected.

Change-Id: Ib4883d1766d314bcd415308a9e4805e196462f3a
Signed-off-by: Wootak Jung <wootak.jung@samsung.com>
profiles/input/input.conf