Bluetooth: SMP: Fail if remote and local public keys are identical
Summary
GSD-2021-1000523: Bluetooth: SMP: Fail if remote and local public keys are identical. Affects Kernel versions >= bfe01a5ba2490f299e1d2d5508cbbbadd897bbe9, < f97257cde764ad6979a7dbeb460b9fb69276342e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the operating system that manages system resources and provides an interface for other software to interact with the hardware. It plays a crucial role in the overall functionality and stability of the system. The vulnerability specifically impacts the Bluetooth Secure Simple Pairing (SMP) protocol, which is used for establishing secure connections between Bluetooth devices. The vulnerability arises when the remote and local public keys in the SMP protocol are identical.
Vulnerability Detail
The vulnerability in the Bluetooth SMP protocol occurs when the remote and local public keys are identical. This can potentially lead to security issues as it undermines the integrity of the secure connection between Bluetooth devices. An attacker could exploit this vulnerability to perform various attacks, such as man-in-the-middle attacks, eavesdropping, or unauthorized access to sensitive information exchanged over the Bluetooth connection. The vulnerability was introduced in version v3.17 of the Linux Kernel and has been fixed in version v5.4.122.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the Kernel package to the fixed version.
Conclusion
The vulnerability in the Bluetooth SMP protocol, where the remote and local public keys are identical, can pose significant security risks. It is crucial to update the Linux Kernel package to version v5.4.122 or later to address this vulnerability and mitigate the potential attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to security breaches, including man-in-the-middle attacks, eavesdropping, and unauthorized access to sensitive information exchanged over Bluetooth connections.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the vulnerability has been fixed in version v5.4.122 of the Linux Kernel. It is recommended to update the Kernel package to this version or later to mitigate the security risks.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the fix promptly to prevent potential security breaches.
You can refer to the vulnerability details in the GSD database at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/GSD-2021-1000523.json for more information.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
