ID

VAR-202105-0146

CVE

CVE-2020-26558

TITLE

Devices supporting Bluetooth Core and Mesh Specifications are vulnerable to impersonation attacks and AuthValue disclosure

DESCRIPTION

Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time. Devices supporting the Bluetooth Core and Mesh Specifications are vulnerable to impersonation attacks and AuthValue disclosure that could allow an attacker to impersonate a legitimate device during pairing.CVE- 2020-26556 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. CVE-2020-26555 Affected Vendor Statement: Android has assessed this issue as High severity for Android OS and will be issuing a patch for this vulnerability in an upcoming Android security bulletin. CVE-2020-26557 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. CVE-2020-26558 Affected Vendor Statement: Android has reviewed this report and assessed this vulnerability as having impact on Android OS. We will be issuing a patch for this vulnerability in an upcoming Android security bulletin. CVE-2020-26559 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. CVE-2020-26560 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. VU#799380.5 Affected Vendor Statement: Our assessment of this report is that it is of negligible security impact on Android.CVE- 2020-26556 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. CVE-2020-26555 Affected Vendor Statement: Android has assessed this issue as High severity for Android OS and will be issuing a patch for this vulnerability in an upcoming Android security bulletin. CVE-2020-26557 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. CVE-2020-26558 Affected Vendor Statement: Android has reviewed this report and assessed this vulnerability as having impact on Android OS. We will be issuing a patch for this vulnerability in an upcoming Android security bulletin. CVE-2020-26559 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. CVE-2020-26560 Not Affected Vendor Statement: Android does not support Bluetooth Mesh so is not vulnerable. VU#799380.5 Affected Vendor Statement: Our assessment of this report is that it is of negligible security impact on Android. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4951-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 07, 2021 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : bluez CVE ID : CVE-2020-26558 CVE-2020-27153 CVE-2021-0129 Debian Bug : 989614 Several vulnerabilities were discovered in Bluez, the Linux Bluetooth protocol stack. For the stable distribution (buster), these problems have been fixed in version 5.50-1.2~deb10u2. We recommend that you upgrade your bluez packages. For the detailed security status of bluez please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bluez Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmEO1iRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QF3xAAkSvKZRi8690yAgH6kahX0wdjgjw6bwEm4AIisUYPcnmTe+eXWo65amXD Gu5RDkjJdwZuiOhjYuEQp/g79f2jRna1gtYhTrErO4G/W2ma8GF/R0ligiDAeUka wrzk5bpY1eeCbyI/EmMSAZdxOYgjoPgsA6Dqj9aRAhfHIJskCBg08KDm3XxAG/ZK 2rZpv/tHw6JU4WcSsyefY1ocPiUe1vcqH7m/cjgpYfW+0YhE01/khdWibNVXpXkl wwULv2HTXBMPY5xJb++3qcCNve1YZwNSpnfqsaoxdWmRvFYoWZHt231dr3GHZmUn GZ5h7Aaf7Ej7WtQ3TwIXNL5j46ibynxIL277Xqf3Ro1w/7qS0upY2NjkFCy4D24K slWJwm2+pWxrXypNnVNTVO7iWmM498MBaA7qQjtQyrFMulv9nY6WlVIxoVmQwUww mbDO/Lmghmwn7Y8cw9oWZ1+NpQg7wcsdDf0nfz59yAsiJoRoPv7ukXimYedL1lLJ ANS0M+ZQgKy1q9qKknD4LIHAZm6vN62/bU2WWLNErlB5mVuRxsEGuSb3Q1DwQzju akUX8tJemcOLif1aXRjut6isjr5w1lSj4WM4vNlFt/ncADwaWlLV/FzFnyViiw1v AlcVMh2v2aCa6kz1vTY+GCTq+qaBjzqvzeK/raepFbDgEzrIQQI= =Xh4j -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202209-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: BlueZ: Multiple Vulnerabilities Date: September 29, 2022 Bugs: #797712, #835077 ID: 202209-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in BlueZ, the worst of which could result in arbitrary code execution. Background ========== BlueZ is the canonical bluetooth tools and system daemons package for Linux. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-wireless/bluez < 5.63 >= 5.63 Description =========== Multiple vulnerabilities have been discovered in BlueZ. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All BlueZ users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-wireless/bluez-5.63" References ========== [ 1 ] CVE-2020-26558 https://nvd.nist.gov/vuln/detail/CVE-2020-26558 [ 2 ] CVE-2021-0129 https://nvd.nist.gov/vuln/detail/CVE-2021-0129 [ 3 ] CVE-2021-3588 https://nvd.nist.gov/vuln/detail/CVE-2021-3588 [ 4 ] CVE-2022-0204 https://nvd.nist.gov/vuln/detail/CVE-2022-0204 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202209-16 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . Software Description: - bluez: Bluetooth tools and daemons Details: It was discovered that BlueZ incorrectly checked certain permissions when pairing. (CVE-2020-26558) Jay LV discovered that BlueZ incorrectly handled redundant disconnect MGMT events. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-27153) Ziming Zhang discovered that BlueZ incorrectly handled certain array indexes. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. ========================================================================== Ubuntu Security Notice USN-5050-1 August 24, 2021 linux-aws-5.8, linux-azure-5.8, linux-gcp-5.8, linux-oracle-5.8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-aws-5.8: Linux kernel for Amazon Web Services (AWS) systems - linux-azure-5.8: Linux kernel for Microsoft Azure cloud systems - linux-gcp-5.8: Linux kernel for Google Cloud Platform (GCP) systems - linux-oracle-5.8: Linux kernel for Oracle Cloud systems Details: It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access control. An authenticated attacker could possibly use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129) Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691) It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564) It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573) It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-38208) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: linux-image-5.8.0-1038-oracle 5.8.0-1038.39~20.04.1 linux-image-5.8.0-1039-gcp 5.8.0-1039.41 linux-image-5.8.0-1040-azure 5.8.0-1040.43~20.04.1 linux-image-5.8.0-1042-aws 5.8.0-1042.44~20.04.1 linux-image-aws 5.8.0.1042.44~20.04.14 linux-image-azure 5.8.0.1040.43~20.04.12 linux-image-gcp 5.8.0.1039.14 linux-image-oracle 5.8.0.1038.39~20.04.14 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-5050-1 CVE-2020-26558, CVE-2021-0129, CVE-2021-28691, CVE-2021-3564, CVE-2021-3573, CVE-2021-38208 Package Information: https://launchpad.net/ubuntu/+source/linux-aws-5.8/5.8.0-1042.44~20.04.1 https://launchpad.net/ubuntu/+source/linux-azure-5.8/5.8.0-1040.43~20.04.1 https://launchpad.net/ubuntu/+source/linux-gcp-5.8/5.8.0-1039.41 https://launchpad.net/ubuntu/+source/linux-oracle-5.8/5.8.0-1038.39~20.04.1

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote or local

TYPE

authorization issue

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

This document was written by Madison Oliver.Statement Date:   February 22, 2021

SOURCES

LAST UPDATE DATE

2026-07-19T20:59:57.942000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE