The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
References
| Link | Resource |
|---|---|
| https://dl.packetstormsecurity.net/papers/general/braktooth.pdf | Technical Description Third Party Advisory |
| https://github.com/espressif/esp-idf | Product Third Party Advisory |
| https://github.com/espressif/esp32-bt-lib | Product Third Party Advisory |
| https://www.espressif.com/en/products/socs/esp32 | Product Vendor Advisory |
| https://dl.packetstormsecurity.net/papers/general/braktooth.pdf | Technical Description Third Party Advisory |
| https://github.com/espressif/esp-idf | Product Third Party Advisory |
| https://github.com/espressif/esp32-bt-lib | Product Third Party Advisory |
| https://www.espressif.com/en/products/socs/esp32 | Product Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 05:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://dl.packetstormsecurity.net/papers/general/braktooth.pdf - Technical Description, Third Party Advisory | |
| References | () https://github.com/espressif/esp-idf - Product, Third Party Advisory | |
| References | () https://github.com/espressif/esp32-bt-lib - Product, Third Party Advisory | |
| References | () https://www.espressif.com/en/products/socs/esp32 - Product, Vendor Advisory |
Information
Published : 2021-09-07 06:15
Updated : 2024-11-21 05:59
NVD link : CVE-2021-28136
Mitre link : CVE-2021-28136
CVE.ORG link : CVE-2021-28136
JSON object : View
Products Affected
espressif
- esp32
- esp-idf
CWE
CWE-787
Out-of-bounds Write