Description
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Bluetooth BR/EDR
5.2 to ≤ 5.2affected
References
- https://kb.cert.org/vuls/id/647177/ ↗
- http://seclists.org/fulldisclosure/2020/Jun/5 ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html ↗
- https://francozappa.github.io/about-bias/ ↗
- https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/ ↗
- http://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.html ↗