Cyber Security
Bluetooth BrakTooth bugs could affect billions of devices
Vulnerabilities collectively referred to as BrakTooth are affecting Bluetooth stacks implemented on system-on-a-chip (SoC) circuits from over a dozen vendors.
The set of issues impact a wide variety of devices, from consumer electronics to industrial equipment. The associated risk ranges from denial-of-service, deadlock condition of the device to arbitrary code execution.
Wide variety of products impacted
Researchers from the Singapore University of Technology and Design have published details about BrakTooth – a new family of security vulnerabilities in commercial Bluetooth stacks.
They assessed 13 Bluetooth devices from close to a dozen SoC vendors counting Intel, Qualcomm, Texas Instruments, and Cypress.
| BT SoC Vendor | BT SoC | Dev. Kit / Product | Sample Code |
| Intel (BT 5.2) | AX200 | Laptop Forge15-R | N.A |
| Qualcomm (BT 5.2) | WCN3990 | Xioami Pocophone F1 | N.A |
| Texas Instruments (BT 5.1) | CC2564C | CC256XCQFN-EM | SPPDMMultiDemo |
| Zhuhai Jieli Technology (BT 5.1) | AC6366C | AC6366C_DEMO_V1.0 | app_keyboard |
| Cypress (BT 5.0) | CYW20735B1 | CYW920735Q60EVB-01 | rfcomm_serial_port |
| Bluetrum Technology (BT 5.0) | AB5301A | AB32VG1 | Default |
| Zhuhai Jieli Technology (BT 5.0) | AC6925C | XY-WRBT Module | N.A |
| Actions Technology (BT 5.0) | ATS281X | Xiaomi MDZ-36-DB | N.A |
| Zhuhai Jieli Technology (BT 4.2) | AC6905X | BT Audio Receiver | N.A |
| Espressif Systems (BT 4.2) | ESP32 | ESP-WROVER-KIT | bt_spp_acceptor |
| Harman International (BT 4.1) | JX25X | JBL TUNE500BT | N.A |
| Qualcomm (BT 4.0) | CSR 8811 | Laird DVK-BT900-SA | vspspp.server.at |
| Silabs (BT 3.0+HS) | WT32i | DKWT32I-A | ai-6.3.0-1149 |
Digging deeper, the researchers discovered that more than 1,400 product listings are affected by BrakTooth, and the list includes but is not limited to the following types of devices:
- Smartphones
- Infotainment systems
- Laptop and desktop systems
- Audio devices (speakers, headphones)
- Home entertainment systems
- Keyboards
- Toys
- Industrial equipment (e.g. programmable logic controllers – PLCs)
Considering the variety of products affected, saying that BrakTooth affects billions of devices is likely an accurate estimation.
The researchers say that the risk associated with the BrakTooth set of security flaws ranges from denial-of-service (DoS) by crashing the device firmware, or a deadlock condition where Bluetooth communication is no longer possible, to arbitrary code.
Someone pulling a BrakTooth attack would need an ESP32 development kit, a custom Link Manager Protocol (LMP) firmware, and a computer to run the proof-of-concept (PoC) tool.
Of the 16 BrakTooth vulnerabilities, one of them tracked as CVE-2021-28139 presents a higher risk than others because it allows arbitrary code execution.
It affects devices with an ESP32 SoC circuit, which is found in numerous IoT appliances for home or industry automation.
The researchers demonstrate the attack in the video below by changing the state of an actuator using an LMP Feature Response Extended packet:
Devices running on the AX200 SoC from Intel and Qualcomm’s WCN3990 SoC are vulnerable to a DoS condition triggered when sending a malformed packet.
The list of products impacted includes laptops and desktops from Dell (Optiplex, Alienware), Microsoft Surface devices (Go 2, Pro 7, Book 3), and smartphones (e.g. Pocophone F1, Oppo Reno 5G).
The researchers informed all vendors whose products they found to be vulnerable to BrakTooh ahead of the publication of their findings but only some of them have been patched.
The vulnerabilities in the Braktooth collection target the LMP and baseband layers. Currently, they’ve been assigned 20 identifiers with a few more pending, and refer to the following 16 issues:
- Feature Pages Execution (CVE-2021-28139 – arbitrary code execution/deadlock)
- Truncated SCO Link Request (CVE-2021-34144 – deadlock)
- Duplicated IOCAP (CVE-2021-28136 – crash)
- Feature Response Flooding (CVE-2021-28135, CVE-2021-28155, CVE-2021-31717 – crash)
- LMP Auto Rate Overflow (CVE-2021-31609, CVE-2021-31612 – crash)
- LMP 2-DH1 Overflow (pending CVE – deadlock)
- LMP DM1 Overflow (CVE-2021-34150 – deadlock)
- Truncated LMP Accepted (CVE-2021-31613 – crash)
- Invalid Setup Complete (CVE-2021-31611 – deadlock)
- Host Conn. Flooding (CVE-2021-31785 – deadlock)
- Same Host Connection (CVE-2021-31786 – deadlock)
- AU Rand Flooding (CVE-2021-31610, CVE-2021-34149, CVE-2021-34146, CVE-2021-34143 – crash/deadlock)Invalid Max Slot Type (CVE-2021-34145 – crash)
- Max Slot Length Overflow (CVE-2021-34148 – crash)
- Invalid Timing Accuracy (CVE-2021-34147 and two more pending CVEs – crash)
- Paging Scan Deadlock (pending CVE – deadlock)