Bug 1918601 (CVE-2020-26555)

Summary:	CVE-2020-26555 kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, allarkin, bhu, bmasney, bnocera, chwhite, crwood, cye, cyin, darcari, dbohanno, debarbos, dvlasenk, dzickus, ezulian, hdegoede, hkrzesin, hwkernel-mgr, jarod, jarodwilson, jdenham, jeremy, jfaracco, jforbes, jlelli, joe.lawrence, jonathan, josef, jshortt, jstancek, jwboyer, jwyatt, kcarcia, kernel-maint, kernel-mgr, ldoskova, lgoncalv, linville, lzampier, masami256, mcascell, mchehab, mstowell, nmurray, ptalbert, qzhao, rkeshri, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, steved, tglozar, tyberry, walters, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1919278, 1919279, 1960016, 1960017, 1960018, 1964967, 1990225, 1990226
Bug Blocks:	1904532

Description Dhananjay Arunesh 2021-01-21 08:01:51 UTC

A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.

Comment 6 Rohit Keshri 2021-05-12 19:29:34 UTC

Mitigation:

It is recommended that devices not accept connections from or initiate connections to remote devices claiming the same Bluetooth device address as their own, also a controller computing a null (zero-valued) combination not accept this key as a valid and fail any pairing attempt that produced a null key.

It is also recommends that BR/EDR implementations enable Secure Simple Pairing, and where possible, implementations enable and enforce Secure Connections Only Mode, ensuring that pin-code pairing cannot be used.

Comment 10 Rohit Keshri 2021-05-26 12:56:58 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1964967]

Comment 29 errata-xmlrpc 2024-04-30 10:07:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394