PT-2021-4296 · Espressif · Espressif Esp-Idf

Published 2021-09-07 · Updated 2021-09-09 · CVE-2021-28136

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions 4.4 and earlier

Description The issue is related to the Bluetooth Classic implementation, which does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process. This allows attackers in radio range to trigger memory corruption, and consequently a crash, in ESP32 via a replayed LMP packet. The vulnerability can be exploited by a remote attacker using a specially crafted LMP packet, leading to a denial of service.

Recommendations For Espressif ESP-IDF versions 4.4 and earlier, consider disabling the Bluetooth Classic implementation until a patch is available to prevent exploitation. Restrict access to the pairing process to minimize the risk of memory corruption. Avoid using the LMP IO Capability Request packets in the affected implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-04905

CVE-2021-28136

Affected Products

Espressif Esp-Idf

References · 9

• https://osv.dev/vulnerability/CVE-2021-28136 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04905 · Security Note
• https://espressif.com/en/products/socs/esp32 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28136 · Security Note
• https://github.com/espressif/esp-idf · Note
• https://github.com/espressif/esp32-bt-lib · Note
• https://cybersecurity-help.cz/vdb/SB2021090603 · Note
• https://t.me/cibsecurity/28317 · Telegram Post
• https://dl.packetstormsecurity.net/papers/general/braktooth.pdf · Note