CVE-2021-3436: BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known
BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions >= 1.14.2, >= 2.4.0, >= 2.5.0 contain Use of Multiple Resources with Duplicate Identifier (CWE-694). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j76f-35mc-4h63
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zephyrproject-rtos/zephyrto a version that resolves this vulnerability.Fixed in 1.14.2 - Upgrade
Upgrade
zephyrproject-rtos/zephyrto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
zephyrproject-rtos/zephyrto a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
What is CVE-2021-3436?
CVE-2021-3436 is a vulnerability that allows for the overwriting of an existing bond during the keys distribution phase when the identity address of the bond is known.
Which software versions are affected by CVE-2021-3436?
Zephyr versions >= 1.14.2, >= 2.4.0, and >= 2.5.0 are affected by CVE-2021-3436.
What is the severity of CVE-2021-3436?
CVE-2021-3436 has a severity level of 6.5 (medium).
How can I fix CVE-2021-3436?
To fix CVE-2021-3436, it is recommended to upgrade to a version of Zephyr that is not affected by the vulnerability.
Where can I find more information about CVE-2021-3436?
More information about CVE-2021-3436 can be found at http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j76f-35mc-4h63.