CVE-2020-26558
First published: Thu Jan 21 2021(Updated: )
A vulnerability was found in Linux Kernel, where Passkey Entry protocol used in Secure Simple Pairing (SSP), Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable to an impersonation attack where an active attacker can impersonate the initiating device without any previous knowledge. Refer: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f</a>
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/bluez | <0:5.56-1.el8 | 0:5.56-1.el8 |
| Bluetooth Bluetooth Core Specification | >=2.1<=5.2 | |
| Fedoraproject Fedora | =34 | |
| Debian Debian Linux | =9.0 | |
| Linux Linux kernel | <5.13 | |
| Intel Ax210 Firmware | ||
| Intel Ax210 | ||
| Intel Ax201 Firmware | ||
| Intel Ax201 | ||
| Intel Ax200 Firmware | ||
| Intel Ax200 | ||
| Intel Ac 9560 Firmware | ||
| Intel Ac 9560 | ||
| Intel Ac 9462 Firmware | ||
| Intel Ac 9462 | ||
| Intel Ac 9461 Firmware | ||
| Intel Ac 9461 | ||
| Intel Ac 9260 Firmware | ||
| Intel Ac 9260 | ||
| Intel Ac 8265 Firmware | ||
| Intel Ac 8265 | ||
| Intel Ac 8260 Firmware | ||
| Intel Ac 8260 | ||
| Intel Ac 3168 Firmware | ||
| Intel Ac 3168 | ||
| Intel Ac 7265 Firmware | ||
| Intel Ac 7265 | ||
| Intel Ac 3165 Firmware | ||
| Intel Ac 3165 | ||
| Intel Ax1675 Firmware | ||
| Intel Ax1675 | ||
| Intel Ax1650 Firmware | ||
| Intel Ax1650 | ||
| Intel Ac 1550 Firmware | ||
| Intel Ac 1550 | ||
| All of | ||
| Intel Ax210 Firmware | ||
| Intel Ax210 | ||
| All of | ||
| Intel Ax201 Firmware | ||
| Intel Ax201 | ||
| All of | ||
| Intel Ax200 Firmware | ||
| Intel Ax200 | ||
| All of | ||
| Intel Ac 9560 Firmware | ||
| Intel Ac 9560 | ||
| All of | ||
| Intel Ac 9462 Firmware | ||
| Intel Ac 9462 | ||
| All of | ||
| Intel Ac 9461 Firmware | ||
| Intel Ac 9461 | ||
| All of | ||
| Intel Ac 9260 Firmware | ||
| Intel Ac 9260 | ||
| All of | ||
| Intel Ac 8265 Firmware | ||
| Intel Ac 8265 | ||
| All of | ||
| Intel Ac 8260 Firmware | ||
| Intel Ac 8260 | ||
| All of | ||
| Intel Ac 3168 Firmware | ||
| Intel Ac 3168 | ||
| All of | ||
| Intel Ac 7265 Firmware | ||
| Intel Ac 7265 | ||
| All of | ||
| Intel Ac 3165 Firmware | ||
| Intel Ac 3165 | ||
| All of | ||
| Intel Ax1675 Firmware | ||
| Intel Ax1675 | ||
| All of | ||
| Intel Ax1650 Firmware | ||
| Intel Ax1650 | ||
| All of | ||
| Intel Ac 1550 Firmware | ||
| Intel Ac 1550 | ||
| redhat/bluez | <5.57 | 5.57 |
| Google Android | ||
| debian/bluez | 5.55-3.1+deb11u1 5.55-3.1+deb11u2 5.66-1+deb12u2 5.66-1+deb12u1 5.77-1 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.106-3 6.1.112-1 6.11.4-1 6.11.5-1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-26558 https://nvd.nist.gov/vuln/detail/CVE-2020-26558
- https://bugzilla.redhat.com/show_bug.cgi?id=1918602
- https://access.redhat.com/errata/RHSA-2021:4432
- https://access.redhat.com/security/cve/cve-2020-26558
- https://kb.cert.org/vuls/id/799380
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
- https://security.gentoo.org/glsa/202209-16
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
- https://www.debian.org/security/2021/dsa-4951
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
- https://launchpad.net/bugs/cve/CVE-2020-26558
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1964968
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=00da0fb4972cf59e1c075f313da81ea549cb8738
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1965051
- https://source.android.com/docs/security/bulletin/2021-06-01/#asterisk
- https://source.android.com/docs/security/bulletin/2021-06-01 (Advisory)
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/passkey-entry/
- https://git.kernel.org/linus/6d19628f539fccf899298ff02ee4c73e4bf6df3f
- https://security-tracker.debian.org/tracker/CVE-2020-26558
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26558
- https://nvd.nist.gov/vuln/detail/CVE-2020-26558
- https://ubuntu.com/security/CVE-2020-26558
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/severity
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-26558
- collector/android-source
- source/Android
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- package-manager/redhat
- vendor/bluetooth
- canonical/bluetooth bluetooth core specification
- version/bluetooth bluetooth core specification/2.1
- version/bluetooth bluetooth core specification/5.2
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/linux
- canonical/linux linux kernel
- vendor/intel
- canonical/intel ax210 firmware
- canonical/intel ax210
- canonical/intel ax201 firmware
- canonical/intel ax201
- canonical/intel ax200 firmware
- canonical/intel ax200
- canonical/intel ac 9560 firmware
- canonical/intel ac 9560
- canonical/intel ac 9462 firmware
- canonical/intel ac 9462
- canonical/intel ac 9461 firmware
- canonical/intel ac 9461
- canonical/intel ac 9260 firmware
- canonical/intel ac 9260
- canonical/intel ac 8265 firmware
- canonical/intel ac 8265
- canonical/intel ac 8260 firmware
- canonical/intel ac 8260
- canonical/intel ac 3168 firmware
- canonical/intel ac 3168
- canonical/intel ac 7265 firmware
- canonical/intel ac 7265
- canonical/intel ac 3165 firmware
- canonical/intel ac 3165
- canonical/intel ax1675 firmware
- canonical/intel ax1675
- canonical/intel ax1650 firmware
- canonical/intel ax1650
- canonical/intel ac 1550 firmware
- canonical/intel ac 1550
- vendor/google
- canonical/google android
- package-manager/debian