Bluetooth: SMP: Fail if remote and local public keys are identical
Summary
GSD-2021-1000527: Bluetooth: SMP: Fail if remote and local public keys are identical. Affects Kernel versions >= bfe01a5ba2490f299e1d2d5508cbbbadd897bbe9, < 75523bbfb0eaead670c97fbcf096ca2ab556f0c0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the Kernel package in the Linux ecosystem. The Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for software to interact with the hardware. It plays a crucial role in the overall stability and security of the system. The vulnerability specifically impacts the Bluetooth Secure Simple Pairing (SMP) protocol, which is used for establishing secure connections between Bluetooth devices. The vulnerability arises when the remote and local public keys in the SMP protocol are identical, leading to potential security risks.
Vulnerability Detail
The vulnerability in the Bluetooth SMP protocol occurs when the remote and local public keys are identical. This can allow an attacker to exploit the protocol and potentially compromise the security of the Bluetooth connection. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v4.4.270 by commit 75523bbfb0eaead670c97fbcf096ca2ab556f0c0. The vulnerability was introduced in version v3.17 by commit bfe01a5ba2490f299e1d2d5508cbbbadd897bbe9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the Bluetooth SMP vulnerability in the Linux Kernel can potentially compromise the security of Bluetooth connections. It is crucial to update the Linux Kernel to version v4.4.270 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if exploited, it could potentially compromise the security of Bluetooth connections.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes the manifest file like package-lock.json to identify open-source vulnerabilities in software.
No specific workaround has been mentioned for this vulnerability. It is recommended to update the Linux Kernel to the fixed version.
The vulnerability was introduced in Linux Kernel version v3.17 and is fixed in version v4.4.270.
You can find more information about this vulnerability in the GSD-2021-1000527.json file in the GSD database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
