Skip to content

kernel: Bluetooth: BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack

David Marlin requested to merge dmarlin/centos-stream-9:RHEL18222 into main

JIRA: https://issues.redhat.com/browse/RHEL-18222

CVE: CVE-2020-26555

    commit 1ffc6f8cc33268731fcf9629fc4438f6db1191fc
    Author: Lee, Chun-Yi <jlee@suse.com>
    Date:   Sun Oct 1 16:59:58 2023 +0800
    
        Bluetooth: Reject connection with the device which has same BD_ADDR
    
        This change is used to relieve CVE-2020-26555. The description of
        the CVE:
    
        Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
        1.0B through 5.2 may permit an unauthenticated nearby device to spoof
        the BD_ADDR of the peer device to complete pairing without knowledge
        of the PIN. [1]
    
        The detail of this attack is in IEEE paper:
        BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
        [2]
    
        It's a reflection attack. The paper mentioned that attacker can induce
        the attacked target to generate null link key (zero key) without PIN
        code. In BR/EDR, the key generation is actually handled in the controller
        which is below HCI.
    
        A condition of this attack is that attacker should change the
        BR_ADDR of his hacking device (Host B) to equal to the BR_ADDR with
        the target device being attacked (Host A).
    
        Thus, we reject the connection with device which has same BD_ADDR
        both on HCI_Create_Connection and HCI_Connection_Request to prevent
        the attack. A similar implementation also shows in btstack project.
        [3][4]
    
        Cc: stable@vger.kernel.org
        Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26555 [1]
        Link: https://ieeexplore.ieee.org/abstract/document/9474325/authors#authors [2]
        Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L3523 [3]
        Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L7297 [4]
        Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
        Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Signed-off-by: David Marlin dmarlin@redhat.com

Merge request reports