Bug 1918601 (CVE-2020-26555)

Summary: CVE-2020-26555 kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, bmasney, brdeoliv, bskeggs, chwhite, darcari, dhoward, dvlasenk, dzickus, fhrbata, fpacheco, gtiwari, hdegoede, hkrzesin, hwkernel-mgr, jarodwilson, jeremy, jforbes, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, nmurray, ptalbert, qzhao, rkeshri, rvrbovsk, security-response-team, steved, swood, walters, wcosta, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1960018, 1990225, 1990226, 1919278, 1919279, 1960016, 1960017, 1964967    
Bug Blocks: 1904532    

Description Dhananjay Arunesh 2021-01-21 08:01:51 UTC
A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.

Comment 6 Rohit Keshri 2021-05-12 19:29:34 UTC
Mitigation:

It is recommended that devices not accept connections from or initiate connections to remote devices claiming the same Bluetooth device address as their own, also a controller computing a null (zero-valued) combination not accept this key as a valid and fail any pairing attempt that produced a null key.

It is also recommends that BR/EDR implementations enable Secure Simple Pairing, and where possible, implementations enable and enforce Secure Connections Only Mode, ensuring that pin-code pairing cannot be used.

Comment 10 Rohit Keshri 2021-05-26 12:56:58 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1964967]