PT-2023-3480 · Unknown · Bluetooth Core Specification

Published 2023-06-02 · Updated 2025-01-10 · CVE-2022-24695

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bluetooth Core Specification versions through 5.3

Description The issue is related to Bluetooth Classic in the Bluetooth Core Specification, where device information for Bluetooth transceivers in Non-Discoverable mode is not properly concealed. An attacker can conduct an efficient over-the-air attack to extract the permanent, unique Bluetooth MAC identifier, device capabilities, and identifiers, potentially containing information about the device owner. This also allows the attacker to establish a connection to the target device.

Recommendations For Bluetooth Core Specification versions through 5.3, consider disabling the Non-Discoverable mode for Bluetooth transceivers until a patch is available to properly conceal device information. Restrict access to device capabilities and identifiers to minimize the risk of exploitation. Avoid using the Bluetooth MAC identifier in affected devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

BDU:2023-03670

CVE-2022-24695

Affected Products

Bluetooth Core Specification

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-24695 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-24695 · Security Note
• https://bdu.fstec.ru/vul/2023-03670 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24695 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24695 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24695 · Vendor Advisory
• https://bluetooth.com/specifications/specs/?keyword=core+specification · Note
• https://bluetooth.com/specifications/specs/core-specification · Note
• https://computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM · Note
• https://sp2023.ieee-security.org/program-papers.html · Note
• https://t.me/cvenotify/107092 · Telegram Post