CVE-2019-19192

The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Protocol (ATT) requests on reception, allowing attackers in radio range to cause an event deadlock or crash via crafted packets.

Recent assessments:

pbarry25 at April 21, 2020 2:11am UTC reported:

This vuln is part of a related batch named SweynTooth from researchers at the Singapore University of Technology and Design. The SweynTooth vulnerabilities lie within certain Bluetooth Low Energy (BLE) SDKs for Systems-on-a-Chip (SoC), which can make proliferating fixes to affected devices in the field a slow going.

Vulnerable devices need to be within BLE radio range in order for an attacker to target. A successful exploit will leave the target in a deadlocked state, triggered by sending two consecutive Attribute Protocol (ATT) request packets during a connection event. If a watchdog or similar mechanism is enabled, an exploited target may restart without intervention (otherwise, a hard powercycle may be required). A detailed explanation can be found here in the original disclosure. It is unclear if the SoC manufacturer has issued fixes for their vulnerable SDK(s).

EDIT: Attacker Value for this item largely depends on the type of device the vulnerable target is and behavior the device exhibits when successfully exploited.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 4