CVE-2022-25836

12.12.2022, 04:15

Bluetooth Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when the MITM negotiates Legacy Passkey Pairing with the pairing Initiator and Secure Connections Passkey Pairing with the pairing Responder and brute forces the Passkey entered by the user into the Initiator. The MITM attacker can use the identified Passkey value to complete authentication with the Responder via Bluetooth pairing method confusion.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	ADJACENT_NETWORK	HIGH	NONE	CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
mitre	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	7.5 HIGH	ADJACENT_NETWORK	HIGH	NONE	CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 38%

Vendor	Product	Version
bluetooth	bluetooth_core_specification	4.0 ≤ 𝑥 ≤ 5.3

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

linux

noble	deferred
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	deferred
focal	deferred
bionic	deferred
xenial	deferred
trusty	deferred

linux-allwinner

noble	dne
mantic	dne
lunar	ignored
kinetic	ignored
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-allwinner-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-aws

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	ignored
xenial	ignored
trusty	ignored

linux-aws-5.0

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-aws-5.11

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-aws-5.3

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-aws-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-aws-5.8

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-aws-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-aws-6.5

noble	dne
mantic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-aws-fips

noble	dne
mantic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-aws-hwe

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	ignored
trusty	dne

linux-azure

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	ignored
xenial	ignored
trusty	ignored

linux-azure-4.15

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-5.11

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-azure-5.3

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-5.8

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-azure-6.5

noble	dne
mantic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-azure-edge

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-azure-fde

kinetic	dne
jammy	needs-triage
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-azure-fde-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-azure-fde-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-azure-fde-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-azure-fips

noble	dne
mantic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-bluefield

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-dell300x

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-fips

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	ignored
trusty	ignored

linux-gcp

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	ignored
xenial	ignored
trusty	dne

linux-gcp-4.15

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gcp-5.11

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-gcp-5.3

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gcp-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gcp-5.8

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gcp-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-gcp-6.5

noble	dne
mantic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-gcp-fips

noble	dne
mantic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-gke

noble	needs-triage
kinetic	dne
jammy	needs-triage
focal	ignored
bionic	dne
xenial	ignored
trusty	dne

linux-gke-4.15

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke-5.0

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke-5.15

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-gke-5.3

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gke-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-gkeop

kinetic	dne
jammy	needs-triage
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-gkeop-5.15

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-gkeop-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-hwe

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	ignored
trusty	dne

linux-hwe-5.11

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-hwe-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-hwe-5.8

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-hwe-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-hwe-6.5

noble	dne
mantic	dne
lunar	dne
jammy	deferred
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-hwe-6.8

noble	dne
jammy	deferred
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-hwe-edge

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	ignored
trusty	dne

linux-ibm

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-ibm-5.15

noble	dne
mantic	dne
lunar	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-ibm-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-intel

noble	deferred
mantic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-intel-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-intel-iot-realtime

noble	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-intel-iotg

kinetic	dne
jammy	needs-triage
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-intel-iotg-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-iot

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
focal	deferred
bionic	dne
xenial	dne
trusty	dne

linux-kvm

noble	dne
mantic	dne
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	ignored
xenial	ignored
trusty	dne

linux-laptop

noble	dne
mantic	ignored
lunar	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency-hwe-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency-hwe-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency-hwe-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency-hwe-6.5

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lowlatency-hwe-6.8

noble	dne
jammy	needs-triage
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-lts-xenial

kinetic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	ignored

linux-nvidia

noble	needs-triage
mantic	dne
lunar	dne
kinetic	dne
jammy	deferred
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-nvidia-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-nvidia-6.5

noble	dne
mantic	dne
jammy	deferred
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-nvidia-6.8

noble	dne
jammy	needs-triage
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-nvidia-lowlatency

noble	needs-triage
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	ignored
trusty	dne

linux-oem-5.10

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.14

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.17

noble	dne
mantic	dne
lunar	dne
kinetic	ignored
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-5.6

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oem-6.0

kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-6.1

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-6.5

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-6.8

noble	deferred
mantic	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-oem-osp1

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	ignored
xenial	ignored
trusty	dne

linux-oracle-5.0

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle-5.11

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oracle-5.13

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oracle-5.15

kinetic	dne
jammy	dne
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-oracle-5.3

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-oracle-5.8

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-oracle-6.5

noble	dne
mantic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-raspi

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

linux-raspi-5.4

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-raspi-realtime

noble	dne
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-raspi2

kinetic	dne
jammy	dne
focal	ignored
bionic	ignored
xenial	ignored
trusty	dne

linux-raspi2-5.3

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	dne
trusty	dne

linux-realtime

noble	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-riscv

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	ignored
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-riscv-5.11

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-riscv-5.15

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
focal	deferred
bionic	dne
xenial	dne
trusty	dne

linux-riscv-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-riscv-5.8

kinetic	dne
jammy	dne
focal	ignored
bionic	dne
xenial	dne
trusty	dne

linux-riscv-6.5

noble	dne
mantic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-riscv-6.8

noble	dne
jammy	needs-triage
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-snapdragon

kinetic	dne
jammy	dne
focal	dne
bionic	ignored
xenial	ignored
trusty	dne

linux-starfive

noble	dne
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	dne
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-starfive-5.19

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-starfive-6.2

noble	dne
mantic	dne
lunar	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-starfive-6.5

noble	dne
mantic	dne
jammy	ignored
focal	dne
bionic	dne
xenial	dne
trusty	dne

linux-xilinx-zynqmp

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	needs-triage
focal	deferred
bionic	dne
xenial	dne
trusty	dne

Common Weakness Enumeration

CWE-294 - Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References

https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/