CVE-2021-31615 — Race Condition in Core Specification

CWE-362 — Race ConditionCWE-326 — Inadequate Encryption Strength5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 65.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Bluetooth Core Specification
Timeline
PublishedJun 25
Latest updateMay 24

Description

Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a crafted packet during the receive window of the listening device before the transmitting device initiates its packet transmission to achieve full MITM status without terminating the link. When applied against devices establishing or using encrypted links, crafted packets may be used to terminate an existing link, but will not compromise the confidentiality or…

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 1.6 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-m25v-4656-g8pc: Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4↗2022-05-24
▶
CVEList
CVE-2021-31615: Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4↗2021-06-25
▶
OSV
CVE-2021-31615: Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4↗2021-06-25
▶

📋Vendor Advisories

1
Red Hat
bluetooth: Packet injection may lead to MITM or terminate existing link↗2021-06-28
▶
CVE-2021-31615 — Race Condition in Core Specification | cvebase