PT-2024-18186 · Bluetooth · Bluetooth

Thedjnk · Published 2024-02-19 · Updated 2025-01-17 · CVE-2024-1638

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bluetooth (affected versions not specified)

Description The issue concerns the BT GATT PERM READ LESC and BT GATT PERM WRITE LESC defines for a Bluetooth characteristic, which specify attribute read/write permission with LE Secure Connection encryption. When set, these permissions require LE Secure Connections for read/write access, but only when combined with other permissions, such as BT GATT PERM READ ENCRYPT/BT GATT PERM READ AUTHEN for read or BT GATT PERM WRITE ENCRYPT/BT GATT PERM WRITE AUTHEN for write. If these additional permissions are not set, even in secure connections only mode, the stack does not perform permission checks on these characteristics, allowing them to be freely written or read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-1638

GHSA-P6F3-F63Q-5MC2

Affected Products

Bluetooth

References · 6

• 🔥 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p6f3-f63q-5mc2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1638 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1638 · Vendor Advisory
• https://t.me/cvenotify/71919 · Telegram Post
• https://twitter.com/CVEnew/status/1759694139036500232 · Twitter Post
• https://twitter.com/cracbot/status/1759820231760081176 · Twitter Post