Bugzilla – Bug 1172514
VUL-0: CVE-2020-10134: bluez: Method Confusion Pairing Vulnerability
Last modified: 2022-09-13 11:22:41 UTC
A vulnerability affecting Bluetooth LE Secure Connections was found in the Bluetooth Core specification versions 4.0 through 5.2 and BR/EDR Secure Simple Pairing in the Bluetooth Core specification versions 2.1 through 5.2. The flaw could allow an attacking device to successfully intercede as a man-in-the-middle (MITM) between two pairing devices. To do this, the attacker must negotiate a numeric compare procedure with one device and a passkey pairing procedure with the other, and the user must erroneously enter the numeric compare value as the passkey and accept pairing on the numeric compare device.
This is a problem with Bluetooth user interfaces, not the protocol or its implementation per se.
>The Bluetooth SIG recommends that product developers introduce
>language to user interfaces and/or documentation that warns users to
>not enter the numeric comparison value on the remote pairing device or
>to not enter the numeric comparison value anywhere.
(In reply to Wolfgang Frisch from comment #1)
> This is a problem with Bluetooth user interfaces, not the protocol or its
> implementation per se.
> >The Bluetooth SIG recommends that product developers introduce
> >language to user interfaces and/or documentation that warns users to
> >not enter the numeric comparison value on the remote pairing device or
> >to not enter the numeric comparison value anywhere.
and there seems to be a patch in upstream about disable default setting of bluetooth.
Author: Alain Michaud <email@example.com>
Date: Fri May 29 15:38:13 2020 +0000
adapter: Set default system configuration if available
This change loads any specified system configuration if provided and
supported by the kernel.
I will try and test it and this CVE asap.
So far there is no software solution for this protocol flaw.
The problem only exists under certain circumstances via a man-in-the-middle (MITM) attack between LE device pairing.
A solid workaround would be to disable Bluetooth completely in critical work environments.
Closing as WONTFIX. This is a protocol-level flaw that cannot be fixed in software.