Bug 1215240 (CVE-2020-26557) - VUL-0: CVE-2020-26557: bluez,kernel-source-rt,kernel-source,kernel-source-azure: Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol
Summary: VUL-0: CVE-2020-26557: bluez,kernel-source-rt,kernel-source,kernel-source-azu...
Status: RESOLVED WONTFIX
Alias: CVE-2020-26557
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/377979/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-12 08:37 UTC by Marcus Meissner
Modified: 2024-03-05 11:01 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2023-09-12 08:37:35 UTC 
CVE-2020-26557

Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a
nearby device (without possession of the AuthValue used in the provisioning
protocol) to determine the AuthValue via a brute-force attack (unless the
AuthValue is sufficiently random and changed each time).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26557
Comment 1 Marcus Meissner 2023-09-12 08:49:53 UTC 
Joey, could you state if our software is affected and all and which?
Comment 4 Jan Kara 2024-01-30 13:41:44 UTC 
Joey, any progress on this bug?
Comment 5 Joey Lee 2024-02-05 16:09:32 UTC 
Sorry for I missed this CVE against Mesh Profile. After read the IEEE paper "BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols" and "Mesh Profile Bluetooth ® Specification Revision: v1.0". In the IEEE paper, this CVE-2020-26557 is M-A2 attack. 

I set this issue to WONFIX because the M-A2 attack is against Link Manager layer in chip, likes M-A3 attack (bsc#1215239/CVE-2020-26556 and bsc#1215242/CVE-2020-26559). 

Kernel is NOT aware the M-A2 attack which is in LM layer in chip. So I didn't see solution or workaround can be implemented in bluez.

For remission, the mesh service already be disabled by default because boo#1151518. And bluez package has a warning document :

/usr/share/doc/packages/bluez/README-mesh.SUSE

The bluetooth-mesh dbus system config has been disabled due to security
concerns. See https://bugzilla.opensuse.org/show_bug.cgi?id=1151518 for
details.

If you want to use this feature anyway, copy
bluetooth-mesh.conf to /etc/dbus-1/systemd.d/ and
org.bluez.mesh.service to /etc/dbus-1/system-services/,
then reboot.

If anyone has better idea, just reopen and put suggestion on bug.

Thanks!