Known Bluetooth controller vulnerabilities

BR/EDR

BLE

Identifying whether the device is affected by known vulnerabilities is a fundamental step in any security audit. Validation and verification of the found vulnerabilities is essential to ensure that the assessment is accurate and to avoid false positives.

A particular point of attention lies in the implementation of the lower layers of the Bluetooth standard, which resides within the controller’s firmware. Unlike host side components, this firmware is updated significantly less frequently and may therefore retain unpatched, critical vulnerabilities over extended periods. As a result, the evaluation of the controller firmware is essential for determining the actual exposure of the analyzed device.

Description

The enumeration of known vulnerabilities can be done by searching in vulnerability databases or in general-purpose search engines.

It important to verify the applicability of each of the vulnerabilities found against the analyzed device.

Resources that can be useful for the identification of the driver model on the device can be found in the following table:

ID Description
BSAM-RES-01 Physical identification of the controller
BSAM-RES-02 Identify controller through reports

For vulnerability enumeration the following resources may be of interest:

ID Description
BSAM-RES-03 Vulnerability database search

Example case

For an ESP32 Bluetooth controller, the following results have been identified in different search engines:

Known vulnerabilities should be validated and classified to assess which ones affect and which ones are not applicable to our device.