CVE-2020-26555
published 2021-05-24CVE-2020-26555: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of…
PriorityP424medium5.4CVSS 3.1
AVAACLPRNUINSUCLILAN
EPSS
0.89%
55.6th percentile
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bluetooth | bluetooth_core_specification | 1.1b – 5.2 | — |
| fedoraproject | fedora | — | — |
| android | — | — | |
| linux | linux_kernel | >= 0 < 4.15.0-151.157 | 4.15.0-151.157 |
| linux | linux_kernel | >= 0 < 5.4.0-80.90 | 5.4.0-80.90 |
| linux | linux_kernel | >= 0 < 4.4.0-222.255 | 4.4.0-222.255 |
| linux | linux_kernel | >= 0 < 4.4.0-219.252 | 4.4.0-219.252 |
| platform | system_bt | >= 10:0 < 10:2021-06-05 | 10:2021-06-05 |
| platform | system_bt | >= 11:0 < 11:2021-06-05 | 11:2021-06-05 |
| platform | system_bt | >= 8.1:0 < 8.1:2021-06-05 | 8.1:2021-06-05 |
| platform | system_bt | >= 9:0 < 9:2021-06-05 | 9:2021-06-05 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.04.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:N
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC
cisa_ics·2024-03-14
Siemens SIMATIC
ICS Advisory
##
Siemens SIMATIC
Release DateMarch 14, 2024
Alert CodeICSA-24-074-07
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC
- Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Missing Encryption of Sensitive Data, Incorrect Permission Assignment for Critical Resource, Expected Beha
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2022-03-22·CVSS 7.8
CVE-2020-25673 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the
Linux kernel did not properly restrict access to the cgroups v1
release_agent feature. A local attacker could use this to gain
administrative privileges. (CVE-2022-0492)
It was discovered that the aufs file system in the Linux kernel did not
properly restrict mount namespaces, when mounted with the non-default
allow_userns option set. A local attacker could use this to gain
administrative privileges. (CVE-2016-2853)
It was discovered that the aufs file system in the Linux kernel did not
properly maintain POSIX ACL xattr data, when mounted with the non-default
allow_userns option. A local attacker could possibly us
Android
CVE-2020-26555: Android Security Bulletin 2021-06-01
CVE: CVE-2020-26555
Severity: HIGH
Type: EoP
Affected AOSP versions: 8
vendor_android·2021-06-01·CVSS 5.4
CVE-2020-26555 [MEDIUM] CVE-2020-26555: Android Security Bulletin 2021-06-01
CVE: CVE-2020-26555
Severity: HIGH
Type: EoP
Affected AOSP versions: 8
Android Security Bulletin 2021-06-01
CVE: CVE-2020-26555
Severity: HIGH
Type: EoP
Affected AOSP versions: 8.1, 9, 10, 11
References: A-174626251
Red Hat
kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
vendor_redhat·2021-05-24·CVSS 5.4
CVE-2020-26555 [MEDIUM] CWE-400 kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.
Statement: Red Hat Product Security is aware of this issue and is currently assessing the impact on Red Hat supported products. Corresponding entry in the Red Hat
Kernel
Bluetooth: Reject connection with the device which has same BD_ADDR
kernel_security·2023-10-01·CVSS 5.4
CVE-2020-26555 [MEDIUM] Bluetooth: Reject connection with the device which has same BD_ADDR
Bluetooth: Reject connection with the device which has same BD_ADDR
This change is used to relieve CVE-2020-26555. The description of
the CVE:
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge
of the PIN. [1]
The detail of this attack is in IEEE paper:
BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
[2]
It's a reflection attack. The paper mentioned that attacker can induce
the attacked target to generate null link key (zero key) without PIN
code. In BR/EDR, the key generation is actually handled in the controller
which is below HCI.
A condition of this attack is that attacker should change the
BR_ADDR
Kernel
Bluetooth: hci_event: Ignore NULL link key
kernel_security·2023-10-01·CVSS 5.4
CVE-2020-26555 [MEDIUM] Bluetooth: hci_event: Ignore NULL link key
Bluetooth: hci_event: Ignore NULL link key
This change is used to relieve CVE-2020-26555. The description of the
CVE:
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge
of the PIN. [1]
The detail of this attack is in IEEE paper:
BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
[2]
It's a reflection attack. The paper mentioned that attacker can induce
the attacked target to generate null link key (zero key) without PIN
code. In BR/EDR, the key generation is actually handled in the controller
which is below HCI.
Thus, we can ignore null link key in the handler of "Link Key Notification
event" to relieve th
GHSA
GHSA-6vq6-ghrc-jpjw: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1
ghsa_unreviewed·2022-05-24
CVE-2020-26555 [MEDIUM] CWE-863 GHSA-6vq6-ghrc-jpjw: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2022-03-22·CVSS 7.8
CVE-2022-0492 [HIGH] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the
Linux kernel did not properly restrict access to the cgroups v1
release_agent feature. A local attacker could use this to gain
administrative privileges. (CVE-2022-0492)
It was discovered that the aufs file system in the Linux kernel did not
properly restrict mount namespaces, when mounted with the non-default
allow_userns option set. A local attacker could use this to gain
administrative privileges. (CVE-2016-2853)
It was discovered that the aufs file system in the Linux kernel did not
properly maintain POSIX ACL xattr data, when mounted with the non-default
allow_userns option. A local attacker could possibly use this to gain
elevated privileges. (CVE
OSV
CVE-2020-26555: In btm_sec_pin_code_request of btm_sec
osv·2021-06-01
CVE-2020-26555 CVE-2020-26555: In btm_sec_pin_code_request of btm_sec
In btm_sec_pin_code_request of btm_sec.cc, there is a possible bypass of Bluetooth pairing pin-code due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
OSV
CVE-2020-26555: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1
osv·2021-05-24·CVSS 5.4
CVE-2020-26555 [MEDIUM] CVE-2020-26555: Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
No detection rules found.
No public exploits indexed.
https://kb.cert.org/vuls/id/799380https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.htmlhttps://kb.cert.org/vuls/id/799380https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.htmlhttps://www.kb.cert.org/vuls/id/799380
2021-05-24
Published