PSA: Bluetooth vulnerability and PS3 Controllers on Linux in 2024
PSA: Bluetooth vulnerability and PS3 Controllers on Linux in 2024
In late 2023 a Bluetooth vulnerability CVE-2023-45866 was discovered and patched in Bluez. By now, this vulnerability should be fixed on all Linux distributions. The fix has one compatibility implication: support for insecure legacy devices is now disabled by default. The Sony PlayStation 3 Controller (AKA DualShock 3 or DS3) is probably the most notable device affected by this change.
What to do if you have a PS3 Controller
The PS3 Controller should still be plug-and-play on Linux when used wired, this change only affects wireless use.
Wireless use is now disabled by default. It should still be possible to use the controller wirelessly with a configuration change, but that will make your PC vulnerable when Bluetooth is in discoverable mode — that’s when you’re pairing a device; in GNOME that’s when you just have the Bluetooth settings open; easy to have on by accident.
It’s painful for me to say this (I own several PS3 Controllers), but the DS3 is reaching its end-of-life, and we should start to consider moving on from it as a gamepad for PC.
How to re-enable Bluetooth support for the PS3 Controller
This is insecure: It will make your PC an easy target for remote code execution attacks from anyone in close proximity whenever your Bluetooth is in pairing/discoverable mode. It’s usually hard to notice when Bluetooth is in discoverable mode, and it’s very easy to accidentally leave it on. You have been warned.
TL;DR: The following commands should do it, tested on Fedora 39:
<span style="color:#323232;">sudo sed -Ei~ -e 's/^#ClassicBondedOnly=.*/ClassicBondedOnly=false/' /etc/bluetooth/input.conf
</span><span style="color:#323232;">sudo systemctl restart bluetooth
</span>
Long version: Use the configuration file at /etc/bluetooth/input.conf, under the [General] section, add the option ClassicBondedOnly=false, then restart the bluetooth service or reboot the computer. Your config file should look like the following:
<span style="color:#323232;"># Configuration file for the input service
</span><span style="color:#323232;">
</span><span style="color:#323232;"># This section contains options which are not specific to any
</span><span style="color:#323232;"># particular interface
</span><span style="color:#323232;">[General]
</span><span style="color:#323232;">
</span><span style="color:#323232;"># Set idle timeout (in minutes) before the connection will
</span><span style="color:#323232;"># be disconnect (defaults to 0 for no timeout)
</span><span style="color:#323232;">#IdleTimeout=30
</span><span style="color:#323232;">
</span><span style="color:#323232;"># Enable HID protocol handling in userspace input profile
</span><span style="color:#323232;"># Defaults to false (HIDP handled in HIDP kernel module)
</span><span style="color:#323232;">#UserspaceHID=true
</span><span style="color:#323232;">
</span><span style="color:#323232;"># Limit HID connections to bonded devices
</span><span style="color:#323232;"># The HID Profile does not specify that devices must be bonded, however some
</span><span style="color:#323232;"># platforms may want to make sure that input connections only come from bonded
</span><span style="color:#323232;"># device connections. Several older mice have been known for not supporting
</span><span style="color:#323232;"># pairing/encryption.
</span><span style="color:#323232;"># Defaults to true for security.
</span><span style="color:#323232;">ClassicBondedOnly=false
</span><span style="color:#323232;">
</span><span style="color:#323232;"># LE upgrade security
</span><span style="color:#323232;"># Enables upgrades of security automatically if required.
</span><span style="color:#323232;"># Defaults to true to maximize device compatibility.
</span><span style="color:#323232;">#LEAutoSecurity=true
</span>
I’m posting this PSA on !linux and !linux_gaming. Please forward this message to other interested Linux communities.
Add comment