Moderate
CVE-2019-17061
Moderate
(1 user assessed)
High
(1 user assessed)CVE-2019-17061
Description
The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
Add Assessment
Technical Analysis
This vuln is part of a related batch named SweynTooth from researchers at the Singapore University of Technology and Design. The SweynTooth vulnerabilities lie within certain Bluetooth Low Energy (BLE) SDKs for Systems-on-a-Chip (SoC), which can make proliferating fixes to affected devices in the field a slow going.
Vulnerable devices need to be within BLE radio range in order for an attacker to target. A successful exploit will leave the target in a deadlocked or non-functional state by sending the target a Link Layer ID packet with a value of 0. Device recovery may require a hard reset or powercycle, and a vulnerable device will immediately become vulnerable again once it enables BLE. In their testing, researchers were able to crash a FitBit Inspire device containing this vulnerability, which resulted in a period of ~30 where the Inspire ceased its Bluetooth advertising packets and then restarted itself. A detailed explanation can be found here in the original disclosure, as well as some potentially vulnerable devices in this list. It appears the SoC manufacturer has issued fixes for their vulnerable SDK(s).
Related, the same researchers found an SoC from NXP which also contained a similar vulnerability (CVE-2019-17060), also disclosed as part of SweynTooth.
EDIT: Attacker Value for this item largely depends on the type of device the vulnerable target is and behavior the device exhibits when successfully exploited.
CVSS V3 Severity and Metrics
General Information
Vendors
- cypress
Products
- psoc 4 ble
