Lucene search

MitreCVE-2021-28136

HistorySep 07, 2021 - 6:15 a.m.

CVE-2021-28136

2021-09-0706:15:07

CWE-787

mitre

web.nvd.nist.gov

cve-2021-28136

bluetooth classic

espressif

esp-idf

memory corruption

crash

vulnerability

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.4%

JSON

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.

Affected configurations

Nvd

Node

espressifesp32Match-

AND

espressifesp-idfRange≤4.4

VendorProductVersionCPE
espressifesp32-cpe:2.3:h:espressif:esp32:-:*:*:*:*:*:*:*
espressifesp-idf*cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
espressif	esp32	-	cpe:2.3:h:espressif:esp32:-:::::::*
espressif	esp-idf	*	cpe:2.3:a:espressif:esp-idf::::::::

References

dl.packetstormsecurity.net/papers/general/braktooth.pdf

github.com/espressif/esp-idf

github.com/espressif/esp32-bt-lib

www.espressif.com/en/products/socs/esp32

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.4%

JSON

Related for CVE-2021-28136