CVE-2024-8805: BlueZ HID over GATT Profile RCE Vulnerability

CVE-2024-8805 Overview

CVE-2024-8805 is an improper access control vulnerability in the BlueZ Bluetooth protocol stack. The flaw exists within the implementation of the Human Interface Device (HID) over Generic Attribute Profile (GATT). BlueZ fails to enforce authorization before granting access to profile functionality. Network-adjacent attackers can exploit this weakness without authentication to execute arbitrary code in the context of the current user. The issue was reported through the Zero Day Initiative as ZDI-CAN-25177 and affects BlueZ version 5.77.

Critical Impact
An unauthenticated attacker within Bluetooth range can execute arbitrary code on affected BlueZ installations by abusing the HID over GATT Profile.

Affected Products

BlueZ 5.77
Linux distributions bundling the vulnerable BlueZ package
Debian LTS releases addressed in the January 2025 advisory

Discovery Timeline

2024-11-22 - CVE-2024-8805 published to the National Vulnerability Database
2025-01 - Debian LTS security announcement released
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-8805

Vulnerability Analysis

The vulnerability resides in BlueZ's HID over GATT Profile (HOGP) implementation. HOGP allows Bluetooth Low Energy (BLE) peripherals such as keyboards, mice, and game controllers to communicate with a host over GATT. BlueZ exposes HOGP functionality without adequately verifying that the remote GATT client is authorized to access the profile. This missing authorization check maps to [CWE-284] Improper Access Control.

An attacker within Bluetooth radio range can connect to a target and interact with HID functionality that should require pairing or bonding. Because HID devices inject input events into the host, misuse of this interface can drive arbitrary user actions and, through the ZDI-analyzed code path, achieve code execution in the context of the current user.

Root Cause

The root cause is the absence of an authorization gate prior to exposing HOGP operations to a remote GATT peer. BlueZ treats the incoming connection as trusted for HID interactions without validating pairing state or client identity, allowing unauthenticated peers to reach code paths that were designed for bonded devices.

Attack Vector

Exploitation requires adjacency to the target over Bluetooth. No user interaction and no credentials are required. An attacker crafts a malicious BLE peer that advertises or connects to the victim, then engages the HOGP interface to reach the unauthorized code path. Full technical details are documented in the Zero Day Initiative Advisory ZDI-24-1229.

Detection Methods for CVE-2024-8805

Indicators of Compromise

Unexpected BLE pairing or GATT connection events from unknown device addresses in bluetoothd logs.
New or unrecognized HID input devices appearing under /dev/input/ on Linux hosts with Bluetooth enabled.
Anomalous input-hog or HOGP-related messages in journalctl -u bluetooth output.

Detection Strategies

Monitor bluetoothd and kernel logs for GATT client connections that reach HID characteristics without a completed pairing sequence.
Baseline the set of paired Bluetooth peripherals and alert on newly registered HID devices, particularly on servers or workstations that do not normally use BLE input.
Correlate Bluetooth connection events with subsequent process launches or shell activity from the interactive user session.

Monitoring Recommendations

Enable verbose logging on bluetoothd in environments where BLE peripherals are uncommon and forward those logs to a central analytics platform.
Track installed BlueZ package versions across Linux fleets and flag hosts still running version 5.77.
Include Bluetooth-adjacent asset inventories in vulnerability management scans to identify exposed endpoints.

How to Mitigate CVE-2024-8805

Immediate Actions Required

Upgrade BlueZ to a fixed release provided by your Linux distribution vendor.
On Debian LTS systems, apply the update described in the Debian LTS Announcement January 2025.
Disable the Bluetooth service on hosts that do not require it using systemctl disable --now bluetooth.

Patch Information

Debian LTS published fixed BlueZ packages in January 2025. Administrators should install the latest BlueZ package from their distribution repositories and restart the bluetooth service. Refer to the Zero Day Initiative Advisory ZDI-24-1229 and the Debian announcement for version details.

Workarounds

Physically or logically disable Bluetooth adapters on systems that do not require BLE peripherals.
Restrict Bluetooth discoverability and set adapters to non-connectable when idle.
Enforce strict pairing policies and remove unused bonded devices from the BlueZ database in /var/lib/bluetooth/.

bash

# Configuration example
# Disable Bluetooth on hosts that do not need it
sudo systemctl stop bluetooth
sudo systemctl disable bluetooth

# Verify installed BlueZ version
dpkg -l | grep bluez

# Apply updates on Debian-based systems
sudo apt update && sudo apt install --only-upgrade bluez
sudo systemctl restart bluetooth