CVE-2020-26558
Summary
| CVE | CVE-2020-26558 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-05-24 18:15:00 UTC |
|---|
| Updated | 2023-11-07 03:20:00 UTC |
|---|
| Description | Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| VU#799380 - Devices supporting Bluetooth Core and Mesh Specifications are vulnerable to impersonation attacks and AuthValue disclosure |
MISC |
kb.cert.org |
|
| INTEL-SA-00520 |
CONFIRM |
www.intel.com |
|
| Debian -- Security Information -- DSA-4951-1 bluez |
DEBIAN |
www.debian.org |
|
| BlueZ: Multiple Vulnerabilities (GLSA 202209-16) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| INTEL-SA-00517 |
CONFIRM |
www.intel.com |
|
| [SECURITY] [DLA 2689-1] linux security update |
MLIST |
lists.debian.org |
|
| [SECURITY] [DLA 2692-1] bluez security update |
MLIST |
lists.debian.org |
|
| [SECURITY] [DLA 2690-1] linux-4.19 security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 34 Update: kernel-5.12.7-300.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: kernel-5.12.7-300.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Reporting Security Vulnerabilities | Bluetooth® Technology Website |
MISC |
www.bluetooth.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159514 Oracle Enterprise Linux Security Update for bluez (ELSA-2021-4432)
- 178679 Debian Security Update for linux-4.19 (DLA 2690-1)
- 178680 Debian Security Update for linux (DLA 2689-1)
- 178684 Debian Security Update for bluez (DLA 2692-1)
- 178745 Debian Security Update for bluez (DSA 4951-1)
- 198407 Ubuntu Security Notification for BlueZ vulnerabilities (USN-4989-1)
- 198438 Ubuntu Security Notification for Linux kernel vulnerabilities (USN-5017-1) (Sequoia)
- 198459 Ubuntu Security Notification for Linux, Linux-aws, Linux-aws-hwe, Linux-azure, Linux-azure-4.15, Linux-gcp, (USN-5018-1)
- 198465 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5046-1)
- 198468 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5050-1)
- 239797 Red Hat Update for bluez (RHSA-2021:4432)
- 281098 Fedora Security Update for kernel (FEDORA-2021-a35b44fd9f)
- 352489 Amazon Linux Security Advisory for kernel: ALAS2-2021-1685
- 352831 Amazon Linux Security Advisory for kernel: ALAC2012-2021-030
- 352832 Amazon Linux Security Advisory for kmod-sfc: ALAC2012-2021-031
- 352833 Amazon Linux Security Advisory for kmod-mlx5: ALAC2012-2021-032
- 353147 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2022-004
- 353158 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2022-002
- 610344 Google Android Devices June 2021 Security Patch Missing
- 610354 Google Android July 2021 Security Patch Missing for LGE
- 610355 Google Android July 2021 Security Patch Missing for Samsung
- 610358 Google Android July 2021 Security Patch Missing for Huawei EMUI
- 610374 Google Android October 2021 Security Patch Missing for Huawei EMUI
- 610375 Google Android October 2021 Security Patch Missing for Samsung
- 610376 Google Android October 2021 Security Patch Missing for LGE
- 710631 Gentoo Linux BlueZ Multiple Vulnerabilities (GLSA 202209-16)
- 750748 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:2202-1)
- 750750 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:2184-1)
- 750753 OpenSUSE Security Update for bluez (openSUSE-SU-2021:2291-1)
- 750830 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:2321-1)
- 750832 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:2324-1)
- 750864 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:2421-1)
- 750868 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:2427-1)
- 750869 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:2422-1)
- 750877 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:2427-1)
- 750880 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:2451-1)
- 752696 SUSE Enterprise Linux Security Update for bluez (SUSE-SU-2022:3691-1)
- 752697 SUSE Enterprise Linux Security Update for bluez (SUSE-SU-2022:3687-1)
- 900842 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (9474)
- 902009 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (9474-1)
- 905824 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (9474-2)
