PT-2021-4304 · Cypress · Cypress Wiced Bt Stack

Published 2021-09-07 · Updated 2021-09-14 · CVE-2021-34147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cypress WICED BT stack versions through 2.9.0 for CYW20735B1

Description The Bluetooth Classic implementation in the Cypress WICED BT stack does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress. This issue exists due to insufficient input validation.

Recommendations For Cypress WICED BT stack versions through 2.9.0 for CYW20735B1, consider disabling the Bluetooth Classic implementation until a patch is available to prevent exploitation. As a temporary workaround, restrict the number of reconnections to the link slave to minimize the risk of resource exhaustion. Avoid using the LMP timing accuracy response feature in the affected Bluetooth Classic implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04913

CVE-2021-34147

Affected Products

Cypress Wiced Bt Stack

References · 14

• https://security-tracker.debian.org/tracker/CVE-2021-34147 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34147 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34147 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-34147 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34147 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34147 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34147 · Vendor Advisory
• https://cypress.com/documentation/datasheets/cyw20735b1-single-chip-bluetooth-transceiver-wireless-input-devices · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04913 · Security Note
• https://github.com/RPi-Distro/bluez-firmware/commit/31ad68831357d2019624004f1f0846475671088f · Note
• https://dl.packetstormsecurity.net/papers/general/braktooth.pdf · Note
• https://t.me/cvenotify/20842 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021090612 · Note
• https://t.me/cibsecurity/28326 · Telegram Post