The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
References
| Link | Resource |
|---|---|
| https://dl.packetstormsecurity.net/papers/general/braktooth.pdf | Technical Description Third Party Advisory |
| https://github.com/espressif/esp-idf | Product Third Party Advisory |
| https://github.com/espressif/esp32-bt-lib | Product Third Party Advisory |
| https://www.espressif.com/en/products/socs/esp32 | Product Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
09 Sep 2021, 23:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:* cpe:2.3:h:espressif:esp32:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 3.3
v3 : 6.5 |
| CWE | CWE-787 | |
| References | (MISC) https://www.espressif.com/en/products/socs/esp32 - Product, Vendor Advisory | |
| References | (MISC) https://github.com/espressif/esp-idf - Product, Third Party Advisory | |
| References | (MISC) https://dl.packetstormsecurity.net/papers/general/braktooth.pdf - Technical Description, Third Party Advisory | |
| References | (MISC) https://github.com/espressif/esp32-bt-lib - Product, Third Party Advisory |
07 Sep 2021, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-07 06:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-28136
Mitre link : CVE-2021-28136
CVE.ORG link : CVE-2021-28136
JSON object : View
Products Affected
espressif
- esp32
- esp-idf
CWE
CWE-787
Out-of-bounds Write