PT-2020-19183 · Broadcom+1 · Broadcom Chips+3

Jiska · Published 2020-05-08 · Updated 2023-01-09 · CVE-2020-6616

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Broadcom chips (affected versions not specified) Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset

Description The issue arises from the use of a low-entropy Pseudo Random Number Generator (PRNG) in situations where a Hardware Random Number Generator (HRNG) should be used, leading to potential spoofing. This affects devices such as Samsung Galaxy S8, S8+, and Note8 with the BCM4361 chipset.

Recommendations For Broadcom chips, consider implementing a Hardware Random Number Generator (HRNG) to replace the low-entropy PRNG. For Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset, update the device firmware to a version that utilizes a HRNG for Bluetooth random-number generation, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-6616

Affected Products

Bcm4361 Chipset

Broadcom Chips

Samsung Galaxy Note8

Samsung Galaxy S8

References · 12

• 🔥 https://media.ccc.de/v/DiVOC-6-finding_eastereggs_in_broadcom_s_bluetooth_random_number_generator · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6616 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6616 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb · Vendor Advisory
• https://github.com/seemoo-lab/internalblue/blob/master/doc/rng.md · Note
• http://seclists.org/fulldisclosure/2020/May/49 · Note
• https://twitter.com/naehrdine/status/1255980443368919045 · Note
• https://twitter.com/naehrdine/status/1255981245147877377 · Note
• http://bluetooth.lol · Note
• https://support.apple.com/kb/HT211168 · Note
• https://support.apple.com/kb/HT211100 · Note
• https://support.apple.com/HT211168 · Note