Attribute Read Permission with LE Secure Connection Encryption

CVE-2024-1638

What is CVE-2024-1638?

The vulnerability in the Bluetooth characteristic permissions of Zephyr RTOS arises from a failure to enforce proper access controls when certain permissions are not configured. Specifically, the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC settings are intended to ensure that read and write operations on Bluetooth characteristics require LE Secure Connections. However, this security measure is rendered ineffective if other necessary permissions, such as BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN for reading or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN for writing, are not also enabled. As a result, without these additional permission checks, an attacker could potentially exploit this oversight to gain unauthorized access to sensitive data through unrestricted read or write capabilities, even when secure connections are in operation.

References