The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
References
| Link | Resource |
|---|---|
| https://asset-group.github.io/disclosures/sweyntooth/ | Third Party Advisory |
| https://www.nxp.com/products/wireless/bluetooth-low-energy:BLUETOOTH-LOW-ENERGY-BLE | Vendor Advisory |
| https://asset-group.github.io/disclosures/sweyntooth/ | Third Party Advisory |
| https://www.nxp.com/products/wireless/bluetooth-low-energy:BLUETOOTH-LOW-ENERGY-BLE | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 04:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://asset-group.github.io/disclosures/sweyntooth/ - Third Party Advisory | |
| References | () https://www.nxp.com/products/wireless/bluetooth-low-energy:BLUETOOTH-LOW-ENERGY-BLE - Vendor Advisory |
Information
Published : 2020-02-10 21:51
Updated : 2024-11-21 04:31
NVD link : CVE-2019-17060
Mitre link : CVE-2019-17060
CVE.ORG link : CVE-2019-17060
JSON object : View
Products Affected
nxp
- kw35
- mcuxpresso_software_development_kit
- kw37
- kw34
- kw38
- kw39
- kw36
- kw41z
- kw31z
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')