PT-2022-5920 · Linux+1 · Linux Kernel+1

Published 2022-12-11 · Updated 2025-10-23 · CVE-2022-25837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bluetooth Core Specification versions 1.0B through 5.3 Linux kernel (affected versions not specified)

Description The issue concerns Bluetooth pairing and may allow an unauthenticated Man-In-The-Middle (MITM) attacker to acquire credentials when two devices are paired, one supporting BR/EDR Secure Connections pairing and the other BR/EDR Legacy PIN code pairing. The MITM negotiates BR/EDR Secure Simple Pairing in Secure Connections mode with the pairing Initiator and BR/EDR Legacy PIN code pairing with the pairing Responder, then brute forces the Passkey entered by the user into the Responder as a 6-digit PIN code. The identified PIN code value can be used to complete authentication with the Initiator via Bluetooth pairing method confusion. Additionally, there is a vulnerability in the Linux kernel's Bluetooth driver related to authentication procedure errors, which may allow a remote attacker to elevate their privileges.

Recommendations For Bluetooth Core Specification versions 1.0B through 5.3, consider disabling the BR/EDR Secure Simple Pairing in Secure Connections mode using the Passkey association model as a temporary workaround until a patch is available. For Linux kernel, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-294

Related Identifiers

BDU:2022-07340

CVE-2022-25837

Affected Products

Bluetooth Core Specification

Linux Kernel

References · 12

• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07340 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25837 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25837 · Security Note
• https://ubuntu.com/security/CVE-2022-25837 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25837 · Security Note
• https://t.me/cvenotify/39871 · Telegram Post
• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/confusion-in-br-edr · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25837 · Note
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post
• https://t.me/cibsecurity/54275 · Telegram Post