CVE-2021-34147: Medium severity cypress wireless internet connectivity for embedded devices vulnerability
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-34147?
CVE-2021-34147 is a vulnerability in the Bluetooth Classic implementation in the Cypress WICED BT stack through version 2.9.0 for CYW20735B1.
What is the severity of CVE-2021-34147?
CVE-2021-34147 has a severity rating of 6.5, which is considered medium.
What software is affected by CVE-2021-34147?
The affected software is Cypress Wireless Internet Connectivity For Embedded Devices version up to and including 2.9.0.
How can an attacker exploit CVE-2021-34147?
An attacker can exploit CVE-2021-34147 by sending a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, leading to exhaustion of device Bluetooth resources.
Is Cypress Cyw20735b1 affected by CVE-2021-34147?
No, Cypress Cyw20735b1 is not vulnerable to CVE-2021-34147.