Bluetooth Man-in-the-Middle Vulnerability in Linux Packages: CVE-2023-24023
Summary
CVE-2023-24023: Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It supports a wide range of devices and protocols, including Bluetooth. The vulnerability CVE-2023-24023 affects Bluetooth BR/EDR devices using Secure Simple Pairing and Secure Connections, which are integral for secure device communication. This vulnerability exposes these devices to potential man-in-the-middle attacks, compromising the integrity of encrypted communications.
Vulnerability Detail
CVE-2023-24023 is a vulnerability that allows attackers to exploit Bluetooth BR/EDR devices by forcing a short key length during the pairing process. This can lead to the discovery of the encryption key and enable live injection of malicious data. The vulnerability arises from the implementation of Secure Simple Pairing and Secure Connections in Bluetooth Core Specification versions 4.2 through 5.4. If exploited, it could result in unauthorized access to sensitive information and control over the affected devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can disable Bluetooth functionality on their devices until the system is updated. This can be done through the system settings or by using the command:
sudo systemctl stop bluetooth
This command will stop the Bluetooth service, mitigating the risk of exploitation until a patch is applied.
Conclusion
CVE-2023-24023 is a significant vulnerability affecting Bluetooth communications in Linux packages, allowing for potential man-in-the-middle attacks. Users are advised to update their systems promptly to mitigate risks. Temporary workarounds are available, but the best course of action is to apply the necessary updates as soon as possible.
See every vulnerability recorded for linux →
FAQ
CVE-2023-24023 is a vulnerability affecting Bluetooth BR/EDR devices that allows man-in-the-middle attacks, potentially compromising encrypted communications.
The vulnerability affects Linux packages in Debian 11, 12, and 13, specifically versions prior to the fixed releases: 6.1.76-1 for Debian 12 and 6.6.9-1 for Debian 13.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, control over Bluetooth devices, and potential data breaches.
Yes, the permanent fix is to update the Linux packages to the latest versions that include security patches addressing CVE-2023-24023.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
