{"uuid": "ae3cc16d-4728-4359-9887-7b1bd0d60ea3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28139", "type": "seen", "source": "https://t.me/hacking_Attack/22453", "content": "Black Hat Ethical Hacking\nBluetooth Bugs Open Billions of Devices to DoS, Code Execution\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Bluetooth Bugs Open Billions of Devices to DoS, Code ExecutionPost Views: 70 \nReading Time: 2 Minutes\nResearchers have disclosed a group of 16 different vulnerabilities collectively dubbed BrakTooth, which impact billions of devices that rely on Bluetooth Classic (BT) for communication.\nAccording to an academic paper from the University of Singapore, the bugs are found in the closed commercial BT stack used by at least 1,400 embedded chip components, that can lead to a host of attack types \u2013 mainly denial of service (DoS) via firmware crashes (the term \u201cbrak\u201d is actually Norwegian for \u201ccrash\u201d). One of the bugs can also lead to arbitrary code execution (ACE).\n\nThe team analyzed 13 pieces of BT hardware from 11 vendors; so far, there have been 20 CVEs assigned across them; with four vulnerabilities pending CVE assignments from Intel and Qualcomm. Some of the bugs are patched, others are in the process of being patched; but, researchers said in the paper, \u201cit is highly probable that many other products (beyond the \u22481400 entries observed in Bluetooth listing) are affected by BrakTooth,\u201d including BT system-on-chips (SoCs), BT modules or additional BT end products.\nSee Also: Complete Offensive Security and Ethical Hacking Course Potentially, billions of devices could be affected worldwide, researchers said.\n\nHere\u2019s a table of the 16 bugs:\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/09/02135933/BrakTooth.png \nSummary of new vulnerabilities and other anomalies found (Vx:\u00a0Vulnerability,\u00a0Ax:\u00a0Non-compliance).\nAnd here\u2019s a list of known affected vendors:\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/09/02140009/BrakTook-Vendors.png \nNumber of product listings with respect to BT SoC.\nThe researchers uncovered three main attack scenarios for the bugs, the most severe of which results in ACE on internet-of-things (IoT) devices.\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets Arbitrary Code Execution for Smart Home DevicesThe most critical vulnerability (CVE-2021-28139) affects ESP32 SoCs, a series of low-cost, low-power SoC microcontrollers with integrated Wi-Fi and dual-mode Bluetooth, from the vendor Espressif. These are commonly found in IoT appliances used in industry automation, smart-home device, personal fitness gadgets and more.\n\n\u201cA lack of out-of-bounds check in ESP32 BT Library allows the reception of a mutated LMP_feature_response_ext,\u201d according to the paper. \u201cThis results in the injection of eight bytes of arbitrary data outside the bounds of Extended Feature Page Table.\u201d\n\nTo exploit it, an attacker who knows the firmware layout of a target device can write a known function address (JMP Addr.) to the offset pointed by Features Page field.\n\nResearchers successfully forced ESP32 into erasing data housed in devices\u2019 non-volatile random-access memory (NVRAM), which retains data without applied power. They were also able to disable both BT and Wi-Fi on the device; and most concerningly, control the general-purpose input/output (GPIO) of the device if the attacker knows addresses to attached functions-controlling actuators. GPIO is used to communicate the ON/OFF signals received from connected switches, or the digital readings received from connected sensors, to the CPU.\n\n\u201cThis has serious implications if such an attack is applied to Bluetooth-enabled smart home products,\u201d the researchers warned.\nSee Also: Offensive Security Tool: Starkiller DoSing Laptops & SmartphonesThe second attack scenar[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:25.738420Z"}