CVE-2020-26555: Medium severity Bluetooth Bluetooth Core Specification vulnerability

Published Jan 21, 2021
·
Updated

A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.

Other sources

Bluetooth Core and Mesh Specifications could allow a remote attacker to bypass security restrictions, caused by an impersonation in the BR/EDR PIN Pairing procedure flaw. By spoofing the Bluetooth Device Address (BDADDR) of the device, an attacker could exploit this vulnerability to complete pairing with a known link key, encrypt communications with the vulnerable device, and access any profiles permitted.

— IBM

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BDADDR of the peer device to complete pairing without knowledge of the PIN.

— Launchpad

In btmsecpincoderequest of btmsec.cc, there is a possible bypass of Bluetooth pairing pin-code due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

— OSV

Affected Software

166 affected componentsFixes available
Bluetooth Bluetooth Core Specification>=1.1b<=5.2
Fedoraproject Fedora=34
Intel Ax210 Firmware
Intel Ax210
Intel Ax201 Firmware
Intel Ax201
Intel Ax200 Firmware
Intel Ax200
Intel Ac 9560 Firmware
Intel Ac 9560
Intel Ac 9462 Firmware
Intel Ac 9462
Intel Ac 9461 Firmware
Intel Ac 9461
Intel Ac 9260 Firmware
Intel Ac 9260
Intel Ac 8265 Firmware
Intel Ac 8265
Intel Ac 8260 Firmware
Intel Ac 8260
Intel Ac 3168 Firmware
Intel Ac 3168
Intel Ac 7265 Firmware
Intel Ac 7265
Intel Ac 3165 Firmware
Intel Ac 3165
Intel Killer Wi-fi 6e Ax1675 Firmware
Intel Killer Wi-fi 6e Ax1675
Intel Killer Wi-fi 6 Ax1650 Firmware
Intel Killer Wi-fi 6 Ax1650
Intel Killer Ac 1550 Firmware
Intel Killer Ac 1550
All of the following
Intel Ax210 Firmware
Intel Ax210
All of the following
Intel Ax201 Firmware
Intel Ax201
All of the following
Intel Ax200 Firmware
Intel Ax200
All of the following
Intel Ac 9560 Firmware
Intel Ac 9560
All of the following
Intel Ac 9462 Firmware
Intel Ac 9462
All of the following
Intel Ac 9461 Firmware
Intel Ac 9461
All of the following
Intel Ac 9260 Firmware
Intel Ac 9260
All of the following
Intel Ac 8265 Firmware
Intel Ac 8265
All of the following
Intel Ac 8260 Firmware
Intel Ac 8260
All of the following
Intel Ac 3168 Firmware
Intel Ac 3168
All of the following
Intel Ac 7265 Firmware
Intel Ac 7265
All of the following
Intel Ac 3165 Firmware
Intel Ac 3165
All of the following
Intel Killer Wi-fi 6e Ax1675 Firmware
Intel Killer Wi-fi 6e Ax1675
All of the following
Intel Killer Wi-fi 6 Ax1650 Firmware
Intel Killer Wi-fi 6 Ax1650
All of the following
Intel Killer Ac 1550 Firmware
Intel Killer Ac 1550
IBM Security Verify Governance<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Software Stack<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Virtual Appliance<=ISVG 10.0.2
IBM Security Verify Governance Identity Manager Container<=ISVG 10.0.2
Google Android
android/platform/system/bt>=8.1:0<8.1:2021-06-05
8.1:2021-06-05
android/platform/system/bt>=9:0<9:2021-06-05
9:2021-06-05
android/platform/system/bt>=10:0<10:2021-06-05
10:2021-06-05
android/platform/system/bt>=11:0<11:2021-06-05
11:2021-06-05
ubuntu/linux-aws<4.4.0-1099.104
4.4.0-1099.104
ubuntu/linux-azure<4.15.0-1121.134~14.04.1
4.15.0-1121.134~14.04.1
ubuntu/linux-lts-xenial<4.4.0-219.252~14.04.1
4.4.0-219.252~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-219.252
4.4.0-219.252
ubuntu/linux-aws<4.4.0-1135.149
4.4.0-1135.149
ubuntu/linux-aws-hwe<4.15.0-1109.116~16.04.1
4.15.0-1109.116~16.04.1
ubuntu/linux-azure<4.15.0-1121.134~16.04.1
4.15.0-1121.134~16.04.1
ubuntu/linux-gcp<4.15.0-1106.120~16.04.1
4.15.0-1106.120~16.04.1
ubuntu/linux-hwe<4.15.0-151.157~16.04.1
4.15.0-151.157~16.04.1
ubuntu/linux-kvm<4.4.0-1100.109
4.4.0-1100.109
ubuntu/linux-oracle<4.15.0-1078.86~16.04.1
4.15.0-1078.86~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1069.75
4.4.0-1069.75
ubuntu/linux-fips*
ubuntu/linux<4.15.0-151.157
4.15.0-151.157
ubuntu/linux-aws<4.15.0-1109.116
4.15.0-1109.116
ubuntu/linux-aws-5.4<5.4.0-1054.57~18.04.1
5.4.0-1054.57~18.04.1
ubuntu/linux-azure-4.15<4.15.0-1121.134
4.15.0-1121.134
ubuntu/linux-azure-5.4<5.4.0-1055.57~18.04.1
5.4.0-1055.57~18.04.1
ubuntu/linux-dell300x<4.15.0-1027.32
4.15.0-1027.32
ubuntu/linux-gcp-4.15<4.15.0-1106.120
4.15.0-1106.120
ubuntu/linux-gcp-5.4<5.4.0-1049.53~18.04.1
5.4.0-1049.53~18.04.1
ubuntu/linux-gke-5.4<5.4.0-1049.52~18.04.1
5.4.0-1049.52~18.04.1
ubuntu/linux-gkeop-5.4<5.4.0-1021.22~18.04.1
5.4.0-1021.22~18.04.1
ubuntu/linux-hwe-5.4<5.4.0-80.90~18.04.1
5.4.0-80.90~18.04.1
ubuntu/linux-kvm<4.15.0-1097.99
4.15.0-1097.99
ubuntu/linux-oracle<4.15.0-1078.86
4.15.0-1078.86
ubuntu/linux-oracle-5.4<5.4.0-1052.56~18.04.1
5.4.0-1052.56~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1041.45~18.04.1
5.4.0-1041.45~18.04.1
ubuntu/linux-raspi2<4.15.0-1092.98
4.15.0-1092.98
ubuntu/linux-snapdragon<4.15.0-1109.118
4.15.0-1109.118
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-edge*
ubuntu/linux-gke-4.15*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-fips<4.15.0-2051.53
4.15.0-2051.53
ubuntu/linux-azure-fips<4.15.0-2033.37
4.15.0-2033.37
ubuntu/linux-fips<4.15.0-1066.75
4.15.0-1066.75
ubuntu/linux-gcp-fips<4.15.0-2016.18
4.15.0-2016.18
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-80.90
5.4.0-80.90
ubuntu/linux-aws<5.4.0-1054.57
5.4.0-1054.57
ubuntu/linux-azure<5.4.0-1055.57
5.4.0-1055.57
ubuntu/linux-bluefield<5.4.0-1016.19
5.4.0-1016.19
ubuntu/linux-gcp<5.4.0-1049.53
5.4.0-1049.53
ubuntu/linux-gke<5.4.0-1049.52
5.4.0-1049.52
ubuntu/linux-gkeop<5.4.0-1021.22
5.4.0-1021.22
ubuntu/linux-kvm<5.4.0-1044.46
5.4.0-1044.46
ubuntu/linux-oracle<5.4.0-1052.56
5.4.0-1052.56
ubuntu/linux-raspi<5.4.0-1041.45
5.4.0-1041.45
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde-5.15<5.15.0-1114.123~20.04.1
5.15.0-1114.123~20.04.1
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.8*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1069.73+fips2
5.4.0-1069.73+fips2
ubuntu/linux-azure-fips<5.4.0-1073.76+fips1
5.4.0-1073.76+fips1
ubuntu/linux-fips<5.4.0-1031.36
5.4.0-1031.36
ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1
5.4.0-1067.71~20.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade android/platform/system/bt to a version that resolves this vulnerability.

    Fixed in 8.1:2021-06-05
  2. Upgrade

    Upgrade android/platform/system/bt to a version that resolves this vulnerability.

    Fixed in 9:2021-06-05
  3. Upgrade

    Upgrade android/platform/system/bt to a version that resolves this vulnerability.

    Fixed in 10:2021-06-05
  4. Upgrade

    Upgrade android/platform/system/bt to a version that resolves this vulnerability.

    Fixed in 11:2021-06-05
  5. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1099.104
  6. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1121.134~14.04.1
  7. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-219.252~14.04.1
  8. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-219.252
  9. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1135.149
  10. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1109.116~16.04.1
  11. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1121.134~16.04.1
  12. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.120~16.04.1
  13. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-151.157~16.04.1
  14. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1100.109
  15. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1078.86~16.04.1
  16. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1069.75
  17. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-151.157
  18. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1109.116
  19. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1054.57~18.04.1
  20. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1121.134
  21. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1055.57~18.04.1
  22. Upgrade

    Upgrade ubuntu/linux-dell300x to a version that resolves this vulnerability.

    Fixed in 4.15.0-1027.32
  23. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.120
  24. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.53~18.04.1
  25. Upgrade

    Upgrade ubuntu/linux-gke-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.52~18.04.1
  26. Upgrade

    Upgrade ubuntu/linux-gkeop-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1021.22~18.04.1
  27. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-80.90~18.04.1
  28. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1097.99
  29. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1078.86
  30. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1052.56~18.04.1
  31. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1041.45~18.04.1
  32. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1092.98
  33. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1109.118
  34. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2051.53
  35. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2033.37
  36. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1066.75
  37. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2016.18
  38. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-80.90
  39. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1054.57
  40. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1055.57
  41. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1016.19
  42. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.53
  43. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.4.0-1049.52
  44. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1021.22
  45. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1044.46
  46. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1052.56
  47. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1041.45
  48. Upgrade

    Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.123~20.04.1
  49. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1069.73+fips2
  50. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1073.76+fips1
  51. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1031.36
  52. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1067.71~20.04.1

Event History

Jan 21, 2021
Data Sourced
via Red Hat·08:01 AM
DescriptionSeverityAffected Software
May 24, 2021
CVE Published
via MITRE·05:41 PM
Data Sourced
via MITRE·05:41 PM
Description
Data Sourced
via OSV·06:15 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Jun 1, 2021
Advisory Published
via OSV·12:00 AM
Jun 7, 2021
Data Sourced
via Android·12:00 AM
SeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2020-26555?

CVE-2020-26555 has been assigned a high severity rating due to its potential for impersonation attacks during Bluetooth pairing.

2

How do I fix CVE-2020-26555?

To fix CVE-2020-26555, users should update their affected software or firmware to the latest version provided by their vendors.

3

Which devices are affected by CVE-2020-26555?

CVE-2020-26555 affects various devices including certain versions of Bluetooth Core Specification and specific Intel wireless firmware.

4

What type of attack can CVE-2020-26555 lead to?

CVE-2020-26555 can lead to impersonation attacks during the Bluetooth BR/EDR PIN Pairing procedure.

5

Is there a workaround for CVE-2020-26555?

Currently, the best practice is to promptly apply security updates from manufacturers to mitigate the risk associated with CVE-2020-26555.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203