PT-2022-8926 · Bluetooth Special Interest · Bluetooth Core Specification

Published 2022-11-08 · Updated 2022-11-09 · CVE-2020-35473

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bluetooth Core Specifications versions 4.0 through 5.2

Description An information leakage issue in the Bluetooth Low Energy advertisement scan response and extended scan response may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This issue has also been referred to as an allowlist-based side channel.

Recommendations For Bluetooth Core Specifications versions 4.0 through 5.2, consider disabling the Resolvable Private Addressing (RPA) feature until a patch is available to prevent potential identification of devices through their response to specific scan requests. Restrict access to the Bluetooth Low Energy advertisement scan response and extended scan response to minimize the risk of exploitation. Avoid using RPAs that have been associated with a specific remote device to prevent peer identification through active scan requests. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-294

Related Identifiers

CVE-2020-35473

Affected Products

Bluetooth Core Specification

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-35473 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35473 · Vendor Advisory
• https://t.me/cibsecurity/52620 · Telegram Post
• https://t.me/cvenotify/37253 · Telegram Post
• https://sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.html · Note
• https://dl.acm.org/doi/10.1145/3548606.3559372 · Note