CVE-2020-10134

Publication date 19 May 2020

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user erroneously completes both pairing procedures with the MITM using the confirmation number of one peer as the passkey of the other. An adjacent, unauthenticated attacker could be able to initiate any Bluetooth operation on either attacked device exposed by the enabled Bluetooth profiles. This exposure may be limited when the user must authorize certain access explicitly, but so long as a user assumes that it is the intended remote device requesting permissions, device-local protections may be weakened.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
bluez	24.04 LTS noble	Vulnerable, fix deferred
	23.10 mantic	Ignored
	23.04 lunar	Ignored
	22.10 kinetic	Ignored
	22.04 LTS jammy	Vulnerable, fix deferred
	21.10 impish	Ignored
	21.04 hirsute	Ignored
	20.10 groovy	Ignored
	20.04 LTS focal	Vulnerable, fix deferred
	19.10 eoan	Ignored
	18.04 LTS bionic	Vulnerable, fix deferred
	16.04 LTS xenial	Vulnerable, fix deferred
	14.04 LTS trusty	Not in release

Notes

seth-arnold

This appears to be a flaw in the protocol; it's possible that any "fixes" for this issue may be strictly user-interface messages to the user.

mdeslaur

no software fix available as of 2021-12-08

Severity score breakdown

Parameter	Value
Base score	6.3 · Medium
Attack vector	Adjacent
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N