Bug 1832397 (CVE-2020-10135)
| Summary: | CVE-2020-10135 kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, airlied, allarkin, bhu, blc, bmasney, bnocera, brdeoliv, bskeggs, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, dhoward, drow, dvlasenk, esammons, ezulian, fhrbata, gtiwari, hdegoede, hkrzesin, itamar, jarod, jarodwilson, jburrell, jdenham, jeremy, jfaracco, jforbes, jlelli, joe.lawrence, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, ldoskova, lgoncalv, linville, lzampier, masami256, mchehab, mcressma, mjg59, mlangsdo, mrehak, mstowell, nmurray, pmatouse, ptalbert, qzhao, rhel-kernel-rts, rogbas, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, security-response-team, steved, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ykopkova, zhijwang |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was discovered in the Bluetooth protocol affecting the Bluetooth BR/EDR authentication. An attacker with physical access to the Bluetooth connection could perform a spoofing attack impersonating the address of a previously paired remote device. This attack may result in the attacking device completing the authentication procedure successfully despite not possessing the link key. This flaw, in turn, could permit an attacker to initiate the Bluetooth Key Negotiation (KNOB) attack more efficiently, potentially gaining full access as the remote paired device.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-28 10:59:54 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1841538, 1841539, 1841540, 1841541, 1841542, 1841543, 1911199 | ||
| Bug Blocks: | 1821831 | ||
|
Description
Mauro Matteo Cascella
2020-05-06 16:31:59 UTC
Acknowledgments: Name: CERT As per the report, for this attack to be successful several conditions are to be met: - the attacker needs to be within wireless range of a vulnerable Bluetooth device - the attacker needs to know the address of the vulnerable device - Secure Connections is not supported by the vulnerable device - Secure Connections is supported, but the attacker is able to downgrade the connection (by clearing bits in its feature mask) Even so, an attempt to establish encryption will still fail and the attacker must rely on the KNOB attack (CVE-2019-9506) to break the encryption. Mitigation: Enforce the Secure Connections Only mode for implementations that do not require support for pairing with legacy devices. Disabling Bluetooth may be a suitable alternative for some environments, please refer to the Red Hat knowledgebase solution [1] for how to disable Bluetooth in Red Hat Enterprise Linux. [1] https://access.redhat.com/solutions/2682931 External References: https://kb.cert.org/vuls/id/647177/ https://francozappa.github.io/about-bias/ Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1841538] This was fixed for Fedora with the 5.8 stable kernel rebases upstream patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=3ca44c16b0dcc764b641ee4ac226909f5c421aa3 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315 |