espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-10-04 02:50:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bluedroid: Fixes for some vulnerabilities.

Browse Source 
This commit fixes 'Impersonation in Passkey entry protocol'
(CVE-2020-26558) and suggests fixes for other vulnerabilites like
'Impersonation in the Pin Pairing Protocol' (CVE-2020-26555) and
'Authentication of the LE Legacy Pairing Protocol'

CVE-2020-26558 can be easily implemented if the peer device can
impersonate our public key. This commit adds a check by comparing our
and received public key and returns failed pairing if keys are same.

This commit also adds comments suggesting to use secure connection when
supported by all devices.
This commit is contained in:
Chinmay Chhajed
2020-12-22 12:36:07 +05:30
committed by bot
parent 45afa158ff
commit d73ebb570b
2 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
components/bt/host/bluedroid/stack/smp/smp_act.c
View File

@@ -760,6 +760,19 @@ void smp_process_pairing_public_key(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
STREAM_TO_ARRAY(p_cb->peer_publ_key.x, p, BT_OCTET32_LEN);
STREAM_TO_ARRAY(p_cb->peer_publ_key.y, p, BT_OCTET32_LEN);
/* Check if the peer device's and own public key are not same. If they are same then
* return pairing fail. This check is needed to avoid 'Impersonation in Passkey entry
* protocol' vulnerability (CVE-2020-26558).*/
if ((memcmp(p_cb->loc_publ_key.x, p_cb->peer_publ_key.x, sizeof(BT_OCTET32)) == 0) &&
(memcmp(p_cb->loc_publ_key.y, p_cb->peer_publ_key.y, sizeof(BT_OCTET32)) == 0)) {
p_cb->status = SMP_PAIR_AUTH_FAIL;
p_cb->failure = SMP_PAIR_AUTH_FAIL;
reason = SMP_PAIR_AUTH_FAIL;
SMP_TRACE_ERROR("%s, Peer and own device cannot have same public key.", __func__);
smp_sm_event(p_cb, SMP_PAIRING_FAILED_EVT, &reason);
return ;
}
/* In order to prevent the x and y coordinates of the public key from being modified,
we need to check whether the x and y coordinates are on the given elliptic curve. */
if (!ECC_CheckPointIsInElliCur_P256((Point *)&p_cb->peer_publ_key)) {