Cloudanix VulnDB

CVE-2018-5383

Medium · 6.8

CVSS

6.8

EPSS

0.8%

Published

Aug 7, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Some older phones and laptops could let nearby attackers secretly listen in on their Bluetooth wireless connections because of a flaw in how they checked security math during pairing.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
Firmware
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Insufficient validation of elliptic curve parameters during Bluetooth Diffie-Hellman key exchange allows a remote attacker within radio range to supply malformed public keys and recover the resulting session encryption key.

Why it matters to the business

Older mobile devices and laptops remain exposed to wireless eavesdropping or session hijacking on Bluetooth links, increasing risk of data leakage in environments still running unpatched legacy hardware.

How an attack unfolds

An attacker within Bluetooth range monitors the pairing or key-exchange phase, injects a crafted public key with invalid curve parameters, forces the victim device to derive a weak or predictable shared secret, and decrypts subsequent traffic without user interaction.

How to fix it

Upgrade affected devices to the vendor-supplied patches released in 2018: macOS 10.13.6 or later, iOS 11.4 or later, Android security patch level 2018-06-05 or later; replace unsupported hardware that cannot receive updates.

How to confirm the fix worked

Confirm device firmware or OS version meets or exceeds the 2018 patch levels listed above; review Bluetooth stack release notes for explicit elliptic-curve parameter validation fixes.

Typical attack path

  1. Position within Bluetooth radio range of target device
  2. Observe or trigger a Bluetooth pairing or reconnection event
  3. Transmit a malicious elliptic-curve public key during Diffie-Hellman exchange
  4. Recover the derived session key from the weak parameters
  5. Decrypt or inject Bluetooth traffic

How to detect it

Review Bluetooth stack logs and pairing event records on affected devices for anomalous public-key values or repeated failed key exchanges; correlate with nearby unknown Bluetooth devices during pairing windows.

What your security team should do

  • Inventory all macOS, iOS, and Android devices still running versions prior to the 2018 patches
  • Prioritize replacement or upgrade of any unpatchable hardware
  • Disable Bluetooth when not required on legacy devices
  • Monitor vendor security bulletins for any remaining downstream TI WL18xx firmware updates

The record

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 firmware-nonfree 0 20190114-1
Debian:12 firmware-nonfree 0 20190114-1
Debian:13 firmware-nonfree 0 20190114-1
Debian:8 firmware-nonfree 0 20161130-5~deb8u1
Red Hat:enterprise_linux:7::client iwl100-firmware 0 0:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::client iwl1000-firmware 0 1:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::client iwl105-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::client iwl135-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::client iwl2000-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::client iwl2030-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::client iwl3160-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::client iwl3945-firmware 0 0:15.32.2.9-72.el7
Red Hat:enterprise_linux:7::client iwl4965-firmware 0 0:228.61.2.24-72.el7
Red Hat:enterprise_linux:7::client iwl5000-firmware 0 0:8.83.5.1_1-72.el7
Red Hat:enterprise_linux:7::client iwl5150-firmware 0 0:8.24.2.2-72.el7
Red Hat:enterprise_linux:7::client iwl6000-firmware 0 0:9.221.4.1-72.el7
Red Hat:enterprise_linux:7::client iwl6000g2a-firmware 0 0:17.168.5.3-72.el7
Red Hat:enterprise_linux:7::client iwl6000g2b-firmware 0 0:17.168.5.2-72.el7
Red Hat:enterprise_linux:7::client iwl6050-firmware 0 0:41.28.5.1-72.el7
Red Hat:enterprise_linux:7::client iwl7260-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::client iwl7265-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::client linux-firmware 0 0:20190429-72.gitddde598.el7
Red Hat:enterprise_linux:7::computenode iwl100-firmware 0 0:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl1000-firmware 0 1:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl105-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl135-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl2000-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl2030-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl3160-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::computenode iwl3945-firmware 0 0:15.32.2.9-72.el7
Red Hat:enterprise_linux:7::computenode iwl4965-firmware 0 0:228.61.2.24-72.el7
Red Hat:enterprise_linux:7::computenode iwl5000-firmware 0 0:8.83.5.1_1-72.el7
Red Hat:enterprise_linux:7::computenode iwl5150-firmware 0 0:8.24.2.2-72.el7
Red Hat:enterprise_linux:7::computenode iwl6000-firmware 0 0:9.221.4.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl6000g2a-firmware 0 0:17.168.5.3-72.el7
Red Hat:enterprise_linux:7::computenode iwl6000g2b-firmware 0 0:17.168.5.2-72.el7
Red Hat:enterprise_linux:7::computenode iwl6050-firmware 0 0:41.28.5.1-72.el7
Red Hat:enterprise_linux:7::computenode iwl7260-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::computenode iwl7265-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::computenode linux-firmware 0 0:20190429-72.gitddde598.el7
Red Hat:enterprise_linux:7::server iwl100-firmware 0 0:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::server iwl1000-firmware 0 1:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::server iwl105-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::server iwl135-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::server iwl2000-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::server iwl2030-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::server iwl3160-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::server iwl3945-firmware 0 0:15.32.2.9-72.el7
Red Hat:enterprise_linux:7::server iwl4965-firmware 0 0:228.61.2.24-72.el7
Red Hat:enterprise_linux:7::server iwl5000-firmware 0 0:8.83.5.1_1-72.el7
Red Hat:enterprise_linux:7::server iwl5150-firmware 0 0:8.24.2.2-72.el7
Red Hat:enterprise_linux:7::server iwl6000-firmware 0 0:9.221.4.1-72.el7
Red Hat:enterprise_linux:7::server iwl6000g2a-firmware 0 0:17.168.5.3-72.el7
Red Hat:enterprise_linux:7::server iwl6000g2b-firmware 0 0:17.168.5.2-72.el7
Red Hat:enterprise_linux:7::server iwl6050-firmware 0 0:41.28.5.1-72.el7
Red Hat:enterprise_linux:7::server iwl7260-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::server iwl7265-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::server linux-firmware 0 0:20190429-72.gitddde598.el7
Red Hat:enterprise_linux:7::workstation iwl100-firmware 0 0:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl1000-firmware 0 1:39.31.5.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl105-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl135-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl2000-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl2030-firmware 0 0:18.168.6.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl3160-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::workstation iwl3945-firmware 0 0:15.32.2.9-72.el7
Red Hat:enterprise_linux:7::workstation iwl4965-firmware 0 0:228.61.2.24-72.el7
Red Hat:enterprise_linux:7::workstation iwl5000-firmware 0 0:8.83.5.1_1-72.el7
Red Hat:enterprise_linux:7::workstation iwl5150-firmware 0 0:8.24.2.2-72.el7
Red Hat:enterprise_linux:7::workstation iwl6000-firmware 0 0:9.221.4.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl6000g2a-firmware 0 0:17.168.5.3-72.el7
Red Hat:enterprise_linux:7::workstation iwl6000g2b-firmware 0 0:17.168.5.2-72.el7
Red Hat:enterprise_linux:7::workstation iwl6050-firmware 0 0:41.28.5.1-72.el7
Red Hat:enterprise_linux:7::workstation iwl7260-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::workstation iwl7265-firmware 0 0:22.0.7.0-72.el7
Red Hat:enterprise_linux:7::workstation linux-firmware 0 0:20190429-72.gitddde598.el7
SUSE:Enterprise Storage 4 kernel-firmware 0 20170530-21.28.1
SUSE:Linux Enterprise Desktop 12 SP3 kernel-firmware 0 20170530-21.28.1
SUSE:Linux Enterprise Server 12 SP1-LTSS kernel-firmware 0 20160516git-10.16.1
SUSE:Linux Enterprise Server 12 SP2-BCL kernel-firmware 0 20170530-21.28.1
SUSE:Linux Enterprise Server 12 SP2-LTSS kernel-firmware 0 20170530-21.28.1
SUSE:Linux Enterprise Server 12 SP3 kernel-firmware 0 20170530-21.28.1
SUSE:Linux Enterprise Server 12-LTSS kernel-firmware 0 20140807git-5.11.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 kernel-firmware 0 20160516git-10.16.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2 kernel-firmware 0 20170530-21.28.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP3 kernel-firmware 0 20170530-21.28.1
SUSE:OpenStack Cloud 7 kernel-firmware 0 20170530-21.28.1
Ubuntu:14.04:LTS linux 0 3.11.0-12.19
Ubuntu:14.04:LTS linux-aws 0 4.4.0-1050.54
Ubuntu:14.04:LTS linux-firmware 0 No fix
Ubuntu:14.04:LTS linux-lts-xenial 0 4.4.0-159.187~14.04.1
Ubuntu:16.04:LTS linux 0 4.4.0-159.187
Ubuntu:16.04:LTS linux-aws 0 4.4.0-1090.101
Ubuntu:16.04:LTS linux-aws-hwe 0 4.15.0-1047.49~16.04.1
Ubuntu:16.04:LTS linux-azure 0 4.15.0-1055.60
Ubuntu:16.04:LTS linux-firmware 0 1.157.23
Ubuntu:16.04:LTS linux-gcp 0 4.15.0-1040.42~16.04.1
Ubuntu:16.04:LTS linux-hwe 0 4.15.0-58.64~16.04.1
Ubuntu:16.04:LTS linux-kvm 0 4.4.0-1054.61
Ubuntu:16.04:LTS linux-oracle 0 4.15.0-1021.23~16.04.1
Ubuntu:16.04:LTS linux-raspi2 0 4.4.0-1118.127
Ubuntu:16.04:LTS linux-snapdragon 0 4.4.0-1122.128
Ubuntu:18.04:LTS linux 0 4.15.0-58.64
Ubuntu:18.04:LTS linux-aws 0 4.15.0-1047.49
Ubuntu:18.04:LTS linux-aws-5.0 0 5.0.0-1021.24~18.04.1
Ubuntu:18.04:LTS linux-aws-5.3 0 5.3.0-1016.17~18.04.1
Ubuntu:18.04:LTS linux-aws-5.4 0 5.4.0-1018.18~18.04.1
Ubuntu:18.04:LTS linux-azure 0 5.0.0-1014.14~18.04.1
Ubuntu:18.04:LTS linux-azure-4.15 0 4.15.0-1082.92
Ubuntu:18.04:LTS linux-azure-5.3 0 5.3.0-1007.8~18.04.1
Ubuntu:18.04:LTS linux-azure-5.4 0 5.4.0-1020.20~18.04.1
Ubuntu:18.04:LTS linux-dell300x 0 4.15.0-1005.8
Ubuntu:18.04:LTS linux-firmware 0 1.173.18
Ubuntu:18.04:LTS linux-gcp 0 4.15.0-1040.42
Ubuntu:18.04:LTS linux-gcp-4.15 0 4.15.0-1071.81
Ubuntu:18.04:LTS linux-gcp-5.3 0 5.3.0-1008.9~18.04.1
Ubuntu:18.04:LTS linux-gcp-5.4 0 5.4.0-1019.19~18.04.2
Ubuntu:18.04:LTS linux-gke-4.15 0 4.15.0-1040.42
Ubuntu:18.04:LTS linux-gke-5.0 0 5.0.0-1011.11~18.04.1
Ubuntu:18.04:LTS linux-gke-5.3 0 5.3.0-1011.12~18.04.1
Ubuntu:18.04:LTS linux-gke-5.4 0 5.4.0-1025.25~18.04.1
Ubuntu:18.04:LTS linux-gkeop-5.4 0 5.4.0-1001.1
Ubuntu:18.04:LTS linux-hwe 0 5.0.0-23.24~18.04.1
Ubuntu:18.04:LTS linux-hwe-5.4 0 5.4.0-37.41~18.04.1
Ubuntu:18.04:LTS linux-hwe-edge 0 5.0.0-15.16~18.04.1
Ubuntu:18.04:LTS linux-ibm-5.4 0 5.4.0-1010.11~18.04.2
Ubuntu:18.04:LTS linux-kvm 0 4.15.0-1042.42
Ubuntu:18.04:LTS linux-oem 0 4.15.0-1050.57
Ubuntu:18.04:LTS linux-oem-osp1 0 5.0.0-1010.11
Ubuntu:18.04:LTS linux-oracle 0 4.15.0-1021.23
Ubuntu:18.04:LTS linux-oracle-5.0 0 5.0.0-1007.12~18.04.1
Ubuntu:18.04:LTS linux-oracle-5.3 0 5.3.0-1011.12~18.04.1
Ubuntu:18.04:LTS linux-oracle-5.4 0 5.4.0-1019.19~18.04.1
Ubuntu:18.04:LTS linux-raspi-5.4 0 5.4.0-1013.13~18.04.1
Ubuntu:18.04:LTS linux-raspi2 0 4.15.0-1043.46
Ubuntu:18.04:LTS linux-raspi2-5.3 0 5.3.0-1017.19~18.04.1
Ubuntu:18.04:LTS linux-snapdragon 0 4.15.0-1060.66
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gke 0 5.4.0-1033.35
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 5.8.0-23.24~20.04.1
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 5.10.0-1008.9
Ubuntu:20.04:LTS linux-oem-5.6 0 5.6.0-1007.7
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-riscv 0 5.4.0-24.28
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1009.9~22.04.2
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1010.11~22.04.1
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-38.38~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 5.15.0-1021.26
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-38.38.1~22.04.2
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1004.4
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1006.6~22.04.3
Ubuntu:22.04:LTS linux-raspi 0 5.13.0-1008.9
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-38.38.1~22.04.1
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 5.15.0-1011.13
Ubuntu:24.04:LTS linux 0 6.5.0-9.9
Ubuntu:24.04:LTS linux-aws 0 6.5.0-1008.8
Ubuntu:24.04:LTS linux-azure 0 6.5.0-1007.7
Ubuntu:24.04:LTS linux-gcp 0 6.5.0-1007.7

Related vulnerabilities