high
8
CWE
20 347 325
Advisory Published
CVE Published
CVE Published
Updated

CVE-2018-5383: Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange

First published: Fri Jun 01 2018(Updated: )

A vulnerability in Bluetooth pairing potentially allows an attacker with physical proximity (within 30 meters) to gain unauthorized access via an adjacent network, intercept traffic and send forged pairing messages between two vulnerable Bluetooth devices. This may result in information disclosure, elevation of privilege and/or denial of service. External References: <a href="https://www.kb.cert.org/vuls/id/304725">https://www.kb.cert.org/vuls/id/304725</a> <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00128.html">https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00128.html</a> <a href="https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update">https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update</a>

Credit: Lior Neumann Eli Biham cret@cert.org

Affected SoftwareAffected VersionHow to fix
debian/firmware-nonfree
20210315-3
20230210-5
20241210-1
tvOS<12
12
Android
macOS High Sierra<10.13.5
10.13.5
macOS High Sierra
Apple El Capitan
macOS Mojave<10.14
10.14
Apple iOS, iPadOS, and watchOS<12
12
Android=6.0
Android=6.0.1
Android=7.0
Android=7.1.1
Android=7.1.2
Android=8.0
Android=8.1
iStyle @cosme iPhone OS<11.4
Apple iOS and macOS<10.13

Remedy

https://git.kernel.org/linus/05ddb47a91fa591ed25ad877783a58ae44cc8212

Remedy

https://git.kernel.org/linus/ea169a30a6bf6782a05a51d2b9cf73db151eab8b

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=e94352cf328ae718e47e3899ebd050465755db04

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=897330f38d2db8986fc8965709b1852ba76896a7

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=c84bd6688f6e5863dd57cb1ed0512e732d436cb2

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=70353356f8a01b6593ea94fd6ed6e9593fd0da1f

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=629a5e089e300ba153c1358cca2193a7671c2f80

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=112d300c26dfbb9cebbf63781214c007fc203611

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=3f8243c8c0363fb5752a1b0e9aaafccb3abc3159

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=6be4747ea1d731f661c5320acf3f1273a459d6da

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=9489f5524917a42637c3b46d904fff80818a0766

Remedy

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=534daf431c88b24236d23572039cdd79223b246a

Remedy

https://salsa.debian.org/kernel-team/firmware-nonfree/-/commit/e062fd25f11b8cb582d8e1069f83eb54b72410ab

Remedy

https://salsa.debian.org/kernel-team/firmware-nonfree/-/commit/58677900ea574a55cadc0cacb956ebe092ee5ea4

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is the severity of CVE-2018-5383?

    CVE-2018-5383 is characterized as having a high severity due to the potential for unauthorized access and information interception.

  • How do I fix CVE-2018-5383?

    To fix CVE-2018-5383, update your affected devices to the latest versions provided by the vendor.

  • Which devices are affected by CVE-2018-5383?

    CVE-2018-5383 affects various devices including certain versions of Apple iOS, Android, macOS, and tvOS.

  • What kind of attack does CVE-2018-5383 enable?

    CVE-2018-5383 enables attackers to intercept traffic and send forged pairing messages between vulnerable Bluetooth devices.

  • How far can an attacker be to exploit CVE-2018-5383?

    An attacker exploiting CVE-2018-5383 needs to be in physical proximity, within approximately 30 meters of the targeted devices.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203