Bug 1832397 (CVE-2020-10135) - CVE-2020-10135 kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS)
Summary: CVE-2020-10135 kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS)
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-10135
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1841538 1841539 1841540 1841541 1841542 1841543 1911199
Blocks: 1821831
TreeView+ depends on / blocked
 
Reported: 2020-05-06 16:31 UTC by Mauro Matteo Cascella
Modified: 2021-10-28 10:59 UTC (History)
49 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Bluetooth protocol affecting the Bluetooth BR/EDR authentication. An attacker with physical access to the Bluetooth connection could perform a spoofing attack impersonating the address of a previously paired remote device. This attack may result in the attacking device completing the authentication procedure successfully despite not possessing the link key. This flaw, in turn, could permit an attacker to initiate the Bluetooth Key Negotiation (KNOB) attack more efficiently, potentially gaining full access as the remote paired device.
Clone Of:
Environment:
Last Closed: 2021-10-28 10:59:54 UTC


Attachments (Terms of Use)

Description Mauro Matteo Cascella 2020-05-06 16:31:59 UTC
A vulnerability affecting Bluetooth BR/EDR pairing was found in the Bluetooth Core specification versions 1.0 through 5.2. The flaw could allow an attacking device to spoof the address of a previously paired remote device to successfully complete the authentication procedure with some paired/bonded devices while not possessing the link key. This can permit an attacker to initiate the Bluetooth Key Negotiation attack (KNOB) on encryption key strength without intervening in an ongoing pairing procedure through an injection attack.

Comment 3 Mauro Matteo Cascella 2020-05-07 17:08:33 UTC
Acknowledgments:

Name: CERT

Comment 4 Mauro Matteo Cascella 2020-05-07 18:07:17 UTC
As per the report, for this attack to be successful several conditions are to be met:
- the attacker needs to be within wireless range of a vulnerable Bluetooth device
- the attacker needs to know the address of the vulnerable device
- Secure Connections is not supported by the vulnerable device
- Secure Connections is supported, but the attacker is able to downgrade the connection (by clearing bits in its feature mask)

Even so, an attempt to establish encryption will still fail and the attacker must rely on the KNOB attack (CVE-2019-9506) to break the encryption.

Comment 5 Mauro Matteo Cascella 2020-05-13 15:03:17 UTC
Mitigation:

Enforce the Secure Connections Only mode for implementations that do not require support for pairing with legacy devices. Disabling Bluetooth may be a suitable alternative for some environments, please refer to the Red Hat knowledgebase solution [1] for how to disable Bluetooth in Red Hat Enterprise Linux.

[1] https://access.redhat.com/solutions/2682931

Comment 6 Mauro Matteo Cascella 2020-05-19 14:08:07 UTC
External References:

https://kb.cert.org/vuls/id/647177/
https://francozappa.github.io/about-bias/

Comment 7 Mauro Matteo Cascella 2020-05-29 12:27:04 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1841538]

Comment 14 Justin M. Forbes 2021-04-13 15:47:50 UTC
This was fixed for Fedora with the 5.8 stable kernel rebases upstream patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=3ca44c16b0dcc764b641ee4ac226909f5c421aa3


Note You need to log in before you can comment on or make changes to this bug.