Bug 1172514 (CVE-2020-10134)

Summary:	VUL-0: CVE-2020-10134: bluez: Method Confusion Pairing Vulnerability
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Wolfgang Frisch <wolfgang.frisch>
Component:	Incidents	Assignee:	Joey Lee <jlee>
Status:	RESOLVED WONTFIX	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	abergmann, carlos.lopez, jlee, meissner, rfrohl, smash_bz, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/259779/
See Also:	https://bugzilla.suse.com/show_bug.cgi?id=1171988
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-10134:5.9:(AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Wolfgang Frisch 2020-06-04 11:06:27 UTC

CVE-2020-10134

A vulnerability affecting Bluetooth LE Secure Connections was found in the Bluetooth Core specification versions 4.0 through 5.2 and BR/EDR Secure Simple Pairing in the Bluetooth Core specification versions 2.1 through 5.2. The flaw could allow an attacking device to successfully intercede as a man-in-the-middle (MITM) between two pairing devices. To do this, the attacker must negotiate a numeric compare procedure with one device and a passkey pairing procedure with the other, and the user must erroneously enter the numeric compare value as the passkey and accept pairing on the numeric compare device.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1832216
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10134
https://access.redhat.com/security/cve/CVE-2020-10134
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10134
https://kb.cert.org/vuls/id/534195/
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/method-vulnerability/

Comment 1 Wolfgang Frisch 2020-06-04 11:26:36 UTC

This is a problem with Bluetooth user interfaces, not the protocol or its implementation per se.

>The Bluetooth SIG recommends that product developers introduce
>language to user interfaces and/or documentation that warns users to
>not enter the numeric comparison value on the remote pairing device or
>to not enter the numeric comparison value anywhere.

Comment 2 Al Cho 2020-06-05 09:07:01 UTC

(In reply to Wolfgang Frisch from comment #1)
> This is a problem with Bluetooth user interfaces, not the protocol or its
> implementation per se.
> 

Yes.

> >The Bluetooth SIG recommends that product developers introduce
> >language to user interfaces and/or documentation that warns users to
> >not enter the numeric comparison value on the remote pairing device or
> >to not enter the numeric comparison value anywhere.


and there seems to be a patch in upstream about disable default setting of bluetooth.

commit b42ba9133f0cbdbd0d17ece6475d13b4d57aa304
Author: Alain Michaud <alainm@chromium.org>
Date:   Fri May 29 15:38:13 2020 +0000

    adapter: Set default system configuration if available
    
    This change loads any specified system configuration if provided and
    supported by the kernel.

I will try and test it and this CVE asap.

Comment 5 Alexander Bergmann 2022-04-12 07:10:32 UTC

So far there is no software solution for this protocol flaw.

The problem only exists under certain circumstances via a man-in-the-middle (MITM) attack between LE device pairing.

A solid workaround would be to disable Bluetooth completely in critical work environments.

Comment 6 Carlos López 2022-09-13 11:22:41 UTC

Closing as WONTFIX. This is a protocol-level flaw that cannot be fixed in software.