TI-PSIRT-2019-100036

CVEID: CVE-2019-19193

Publication date: February 19, 2020

Summary

The Bluetooth® low energy peripheral implementation in our SimpleLink™ SDK and our dual-mode Bluetooth link layer can allow reception of the connection indication packet with invalid parameters. This can allow attackers in radio range to potentially crash the device via a crafted packet resulting in a denial of service.

When the Bluetooth low energy peripheral device receives an invalid connection PDU (invalid connection interval or supervision timeout parameters), a connection is attempted by the device. However, the connection does not succeed due to reception of invalid parameters. The connection fail status is indicated by the Bluetooth low energy stack to the application layer (bleGAPConnNotAcceptable). The “Simple Peripheral” example application that TI provides enters an idle state upon receiving the connection fail notification from the Bluetooth low energy stack and does not re-initiate advertisements again. This can potentially lead to a denial of service at an application level.

Potential behavior in devices using SimpleLink SDK with BLE5-STACK

When the Bluetooth low energy peripheral device receives an invalid connection PDU (invalid connection interval or supervision timeout parameters), the device RF core notifies the BLE5-STACK of the invalid condition and BLE5-STACK enters a hang condition. This could leads to a denial of service at an application level.

Potential behavior in devices using dual-model Bluetooth service pack

When the Bluetooth low energy peripheral device receives an invalid connection PDU (invalid connection interval or supervision timeout parameters), a connection is attempted by the device. The connection initially succeeds, but will later timeout due to the invalid parameters. Depending on the interval and timeout parameters settings from the connected remote device, a disconnection event is indicated to the host from the controller via HCI commands after the timeout period. During this period, essentially a denial of service is experienced, and the controller does not re-initiate advertisements again until a device reset occurs.

CVSS base score: 6.8

CVSS vector: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products and versions

Here is the list of affected Bluetooth low energy SDKs:

BLE-STACK

• CC2640R2 SDK, BLE-STACK (SDK v3.30.00.20 and prior versions)
• CC25x0 BLE-STACK (BLE-STACK 1.5.0 and prior versions)
• CC1350 SDK, BLE-STACK (SDK v3.20.xx and prior versions)
• CC26x0 BLE-STACK (BLE-STACK v2.2.3 and prior versions)

BLE5-STACK

• CC2640R2 SDK, BLE5-STACK (SDK v3.30.00.20 and prior versions)
• CC13X2-26X2-SDK BLE5-STACK (SDK v3.40.00.02 and prior versions)

Dual-mode Bluetooth service pack

• Bluetooth service pack for CC256xC: CC256XC-BT-SP (v1.3 and earlier)

Potentially impacted features

The potential vulnerability can impact Bluetooth low energy devices running affected SDK versions that have configured the devices as a Bluetooth low energy peripheral and enabled connectable advertisements.

Suggested mitigations

The following service pack releases address the potential vulnerability:

External references

https://asset-group.github.io/disclosures/sweyntooth/