PT-2020-10084 · Microchip Technology · Blusdk Smart

Published 2020-02-10 · Updated 2020-02-13 · CVE-2019-19195

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microchip Technology BluSDK Smart versions through 6.2 for ATSAMB11 devices

Description The issue is related to the Bluetooth Low Energy implementation, which does not properly restrict link-layer data length on reception. This allows attackers within radio range to cause a denial of service, resulting in a crash, by sending a crafted packet.

Recommendations For versions through 6.2, consider implementing packet length validation to prevent crashes due to oversized packets. As a temporary workaround, restrict access to the Bluetooth Low Energy functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2019-19195

Affected Products

Blusdk Smart

References · 4

• https://microchip.com/wwwproducts/en/ATSAMB11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19195 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19195 · Vendor Advisory
• https://asset-group.github.io/disclosures/sweyntooth · Note