Bugzilla – Bug 1172514
VUL-0: CVE-2020-10134: bluez: Method Confusion Pairing Vulnerability
Last modified: 2022-09-13 11:22:41 UTC
CVE-2020-10134 A vulnerability affecting Bluetooth LE Secure Connections was found in the Bluetooth Core specification versions 4.0 through 5.2 and BR/EDR Secure Simple Pairing in the Bluetooth Core specification versions 2.1 through 5.2. The flaw could allow an attacking device to successfully intercede as a man-in-the-middle (MITM) between two pairing devices. To do this, the attacker must negotiate a numeric compare procedure with one device and a passkey pairing procedure with the other, and the user must erroneously enter the numeric compare value as the passkey and accept pairing on the numeric compare device. References: https://bugzilla.redhat.com/show_bug.cgi?id=1832216 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10134 https://access.redhat.com/security/cve/CVE-2020-10134 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10134 https://kb.cert.org/vuls/id/534195/ https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/method-vulnerability/
This is a problem with Bluetooth user interfaces, not the protocol or its implementation per se. >The Bluetooth SIG recommends that product developers introduce >language to user interfaces and/or documentation that warns users to >not enter the numeric comparison value on the remote pairing device or >to not enter the numeric comparison value anywhere.
(In reply to Wolfgang Frisch from comment #1) > This is a problem with Bluetooth user interfaces, not the protocol or its > implementation per se. > Yes. > >The Bluetooth SIG recommends that product developers introduce > >language to user interfaces and/or documentation that warns users to > >not enter the numeric comparison value on the remote pairing device or > >to not enter the numeric comparison value anywhere. and there seems to be a patch in upstream about disable default setting of bluetooth. commit b42ba9133f0cbdbd0d17ece6475d13b4d57aa304 Author: Alain Michaud <alainm@chromium.org> Date: Fri May 29 15:38:13 2020 +0000 adapter: Set default system configuration if available This change loads any specified system configuration if provided and supported by the kernel. I will try and test it and this CVE asap.
So far there is no software solution for this protocol flaw. The problem only exists under certain circumstances via a man-in-the-middle (MITM) attack between LE device pairing. A solid workaround would be to disable Bluetooth completely in critical work environments.
Closing as WONTFIX. This is a protocol-level flaw that cannot be fixed in software.