Bug 1832397 (CVE-2020-10135)

Summary: CVE-2020-10135 kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS)
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, airlied, allarkin, bhu, blc, bmasney, bnocera, brdeoliv, bskeggs, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, dhoward, drow, dvlasenk, esammons, ezulian, fhrbata, gtiwari, hdegoede, hkrzesin, ichavero, itamar, jarod, jarodwilson, jburrell, jdenham, jeremy, jfaracco, jforbes, jlelli, joe.lawrence, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, ldoskova, lgoncalv, linville, lzampier, masami256, mchehab, mcressma, mjg59, mlangsdo, mrehak, mstowell, nmurray, pmatouse, ptalbert, qzhao, rhel-kernel-rts, rogbas, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, security-response-team, steved, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Bluetooth protocol affecting the Bluetooth BR/EDR authentication. An attacker with physical access to the Bluetooth connection could perform a spoofing attack impersonating the address of a previously paired remote device. This attack may result in the attacking device completing the authentication procedure successfully despite not possessing the link key. This flaw, in turn, could permit an attacker to initiate the Bluetooth Key Negotiation (KNOB) attack more efficiently, potentially gaining full access as the remote paired device.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-28 10:59:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1841538, 1841539, 1841540, 1841541, 1841542, 1841543, 1911199    
Bug Blocks: 1821831    

Description Mauro Matteo Cascella 2020-05-06 16:31:59 UTC
A vulnerability affecting Bluetooth BR/EDR pairing was found in the Bluetooth Core specification versions 1.0 through 5.2. The flaw could allow an attacking device to spoof the address of a previously paired remote device to successfully complete the authentication procedure with some paired/bonded devices while not possessing the link key. This can permit an attacker to initiate the Bluetooth Key Negotiation attack (KNOB) on encryption key strength without intervening in an ongoing pairing procedure through an injection attack.

Comment 3 Mauro Matteo Cascella 2020-05-07 17:08:33 UTC
Acknowledgments:

Name: CERT

Comment 4 Mauro Matteo Cascella 2020-05-07 18:07:17 UTC
As per the report, for this attack to be successful several conditions are to be met:
- the attacker needs to be within wireless range of a vulnerable Bluetooth device
- the attacker needs to know the address of the vulnerable device
- Secure Connections is not supported by the vulnerable device
- Secure Connections is supported, but the attacker is able to downgrade the connection (by clearing bits in its feature mask)

Even so, an attempt to establish encryption will still fail and the attacker must rely on the KNOB attack (CVE-2019-9506) to break the encryption.

Comment 5 Mauro Matteo Cascella 2020-05-13 15:03:17 UTC
Mitigation:

Enforce the Secure Connections Only mode for implementations that do not require support for pairing with legacy devices. Disabling Bluetooth may be a suitable alternative for some environments, please refer to the Red Hat knowledgebase solution [1] for how to disable Bluetooth in Red Hat Enterprise Linux.

[1] https://access.redhat.com/solutions/2682931

Comment 6 Mauro Matteo Cascella 2020-05-19 14:08:07 UTC
External References:

https://kb.cert.org/vuls/id/647177/
https://francozappa.github.io/about-bias/

Comment 7 Mauro Matteo Cascella 2020-05-29 12:27:04 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1841538]

Comment 14 Justin M. Forbes 2021-04-13 15:47:50 UTC
This was fixed for Fedora with the 5.8 stable kernel rebases upstream patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=3ca44c16b0dcc764b641ee4ac226909f5c421aa3