CVE-2020-15802: Medium severity Bluetooth Bluetooth Core Specification vulnerability
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.
Other sources
In smpkeydistribution of smpact.cc, there are possible vulnerabilities in Cross-Transport Key Derivation due to weaknesses in the Bluetooth standard. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 8.0:2020-12-01 - Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 8.1:2020-12-01 - Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 9:2020-12-01 - Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 10:2020-12-01 - Upgrade
Upgrade
android/platform/system/btto a version that resolves this vulnerability.Fixed in 11:2020-12-01
Event History
Frequently Asked Questions
What is CVE-2020-15802?
CVE-2020-15802 is a vulnerability that allows man-in-the-middle attacks on devices supporting Bluetooth before version 5.1, also known as BLURtooth.
What is the severity of CVE-2020-15802?
The severity of CVE-2020-15802 is high, with a severity value of 5.9.
Which devices are affected by CVE-2020-15802?
Devices supporting Bluetooth before version 5.1, such as Google Android, are affected by CVE-2020-15802.
How does CVE-2020-15802 work?
CVE-2020-15802 allows an unauthenticated user to establish a bonding with one transport (either LE or BR/EDR) and replace an existing bonding.
Is there a fix for CVE-2020-15802?
Yes, patching the affected devices to a version of Bluetooth 5.1 or newer will mitigate the vulnerability.