An attacker can exploit this by creating an HCI socket and then executing a setuid binary that performs IOCTL operations on its stdin, stdout, or stderr (e.g., sudo, su, or pkexec). These IOCTL calls trigger the kernel to mark the inherited socket as trusted. Once the HCI_SOCK_TRUSTED flag is set, it is never cleared, allowing an unprivileged user to interact with the Bluetooth management channel to send commands, pair malicious devices, or intercept sensitive data, regardless of the Bluetooth service's current power state. This vulnerability impacts Linux kernel versions prior to 6.4.

Attack Chain

1. Attacker creates a raw HCI socket using socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI).
2. Attacker forks a child process to execute a setuid binary (e.g., /usr/bin/sudo).
3. Attacker uses dup2() to redirect the previously created HCI socket file descriptor to the standard I/O (stderr) of the target setuid binary.
4. The setuid binary executes and performs an ioctl system call to check TTY parameters on its stderr.
5. The kernel hci_sock_ioctl function is triggered by the setuid process; it checks for CAP_NET_ADMIN and, finding it present in the privileged process, marks the socket with HCI_SOCK_TRUSTED.
6. The setuid process exits; the attacker retains the file descriptor for the now-trusted HCI socket.
7. Attacker binds the trusted socket to the management channel using bind() with HCI_CHANNEL_CONTROL.
8. Attacker sends unauthorized Bluetooth management commands (e.g., device pairing, disabling security) to the controller.

Impact

Successful exploitation allows an unprivileged local user to bypass security controls in the Bluetooth subsystem. Impact includes unauthorized device pairing, exfiltration of OOB (Out-of-Band) sensitive data, and the ability to control Bluetooth controller states even if the Bluetooth service is supposedly disabled. This affects any Linux distribution running a vulnerable kernel where common setuid programs perform standard IOCTL operations on inherited file descriptors.

Recommendation

1. Patch systems to a Linux kernel version 6.4 or later, which includes the fix replacing capable() with sk_capable() to validate the original socket opener.
2. If Bluetooth is not required, use rfkill to block Bluetooth devices at the hardware/kernel level as a mitigating control.
3. Audit environments for the presence of setuid binaries identified as triggering IOCTL calls (e.g., sudo, su, pkexec, passwd) to assess the attack surface.