PT-2021-9872 · Texas Instruments · Ti'S Ble Stack

Published 2021-09-20 · Updated 2021-10-07 · CVE-2020-16630

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions TI's BLE stack (affected versions not specified)

Description The issue concerns TI's BLE stack, which caches and reuses the Link Key (LTK) property for a bonded mobile. An LTK can be either an unauthenticated key with no Man-In-The-Middle (MITM) protection, created by Just Works, or an authenticated key with MITM protection, created by Passkey Entry, Numeric Comparison, or Out-Of-Band (OOB). If a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generates an authenticated LTK, a fake mobile with the victim mobile's MAC address can use Just Works to pair with the victim device. The generated LTK will still have the property of authenticated MITM protection, allowing the fake mobile to access attributes with authenticated read/write permission.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-16630

Affected Products

Ti'S Ble Stack

References · 5

• 🔥 https://usenix.org/system/files/sec20-zhang-yue.pdf · Exploit
• http://software-dl.ti.com/simplelink/esd/simplelink_cc13x2_26x2_sdk/3.20.00.68/exports/changelog.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16630 · Security Note
• https://t.me/cibsecurity/29166 · Telegram Post
• https://t.me/cvenotify/22058 · Telegram Post