CVE-2023-21115: BR/EDR link key downgrades in unknown package
Summary
CVE-2023-21115: In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. Affects platform/system/bt across 3 version ranges.
>= 11:0, < 11:2023-06-01
>= 12:0, < 12:2023-06-01
>= 12L:0, < 12L:2023-06-01
Fixed in 11:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unknown package is a component of the Android ecosystem. It is responsible for managing Bluetooth connections and security. The package allows devices to pair and establish secure communication channels using link keys. However, a vulnerability has been discovered in the package that allows for the downgrade of link key types, potentially leading to an escalation of privilege on paired devices. This vulnerability does not require any additional execution privileges and can be exploited without user interaction.
Vulnerability Detail
The vulnerability exists in the btm_sec_encrypt_change function of the unknown package. It arises from improper use of cryptography, which enables the downgrading of link key types. This downgrade can be exploited by an attacker to gain elevated privileges on paired devices. The impact of this vulnerability is significant as it allows an attacker to bypass security measures and potentially gain unauthorized access to sensitive information or perform malicious actions on the compromised device.
How To Fix
Minimum fixed version
11:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
The vulnerability in the unknown package allows for the downgrading of link key types, potentially leading to an escalation of privilege on paired devices. It is crucial to update the affected package to the fixed versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/system/bt →
FAQ
The vulnerability allows an attacker to downgrade link key types, leading to an escalation of privilege on paired devices. This can potentially result in unauthorized access to sensitive information or malicious actions on the compromised device.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability is present in versions 11.0, 12.0, and 12L of the unknown package.
No, there are no known workarounds for this vulnerability at this time.
To protect your devices, it is crucial to update the unknown package to versions 11.0, 12.0, or 12L, which contain the necessary fixes to prevent link key downgrades.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
