Bluetooth BTM_BleVerifySignature Side-Channel Attack
Summary
CVE-2023-40090: In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-12-01
>= 14:0, < 14:2023-12-01
Fixed in 13:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth package is a module in the Android ecosystem that handles Bluetooth functionality. It allows devices to connect and communicate wirelessly. The BTM_BleVerifySignature function in the package is responsible for verifying the signature of Bluetooth Low Energy (BLE) connections. This signature validation ensures the authenticity and integrity of the data exchanged between devices. However, a vulnerability has been discovered in this function that could potentially allow an attacker to bypass the signature validation process.
Vulnerability Detail
The BTM_BleVerifySignature function in the Bluetooth package suffers from a side-channel attack vulnerability. By exploiting this vulnerability, an attacker can gain unauthorized access to a BLE connection without the need for additional execution privileges or user interaction. The vulnerability arises due to the disclosure of side-channel information, which can be used to bypass the signature validation process. This could lead to a remote escalation of privilege, enabling the attacker to perform unauthorized actions on the affected device.
How To Fix
Minimum fixed version
13:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix to ensure the security of the Bluetooth package.
Conclusion
The Bluetooth BTM_BleVerifySignature side-channel attack vulnerability poses a significant risk to the security of BLE connections. It is crucial to update the Bluetooth package to the fixed version provided by the Android team. Failure to apply the fix could result in unauthorized access and potential privilege escalation. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
This vulnerability could allow an attacker to gain unauthorized access to a Bluetooth Low Energy connection, potentially leading to remote escalation of privilege.
No, user interaction is not needed for the exploitation of this vulnerability.
The vulnerability affects Android versions 11, 12, 12L, 13, and 14.
There are no known exploits for this vulnerability at the time of this report.
More information about the fix can be found in the Android Open Source Project (AOSP) repository: [https://android.googlesource.com/platform/packages/modules/Bluetooth/+/495417bd068c35de0729d9a332639bd0699153ff]
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
