SB2021090613 - Multiple vulnerabilities in Qualcomm Pocophone F1

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2021-34147)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the Bluetooth Classic implementations does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple re-connections to the target link slave. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

2) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the Bluetooth Classic implementations does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple re-connections to the target link slave. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

3) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the Bluetooth Classic implementations does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple re-connections to the target link slave. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://asset-group.github.io/disclosures/braktooth/