CVE-2020-6616 : Some Broadcom chips mishandle Bluetooth random-number generation because a low-e

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situations where a Hardware Random Number Generator (HRNG) should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset. The Samsung ID is SVE-2020-16882 (May 2020).

Published 2020-05-08 20:15:12

Updated 2023-01-09 16:41:59

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-6616

Apple » Mac Os X
Versions from including (>=) 10.13.0 and before (<) 10.13.6
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X
Versions from including (>=) 10.14.0 and before (<) 10.14.6
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X
Versions from including (>=) 10.15 and before (<) 10.15.4
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-001
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-002
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-006
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-007
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2020-001
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Supplemental Update
cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Supplemental Update 2
cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-004
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.14.6 Update Security Update 2019-005
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2018-002
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2018-003
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-001
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-002
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-003
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-004
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-005
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-006
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2019-007
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Security Update 2020-001
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
Matching versions
Apple » Mac Os X » Version: 10.13.6 Update Supplemental Update
cpe:2.3:o:apple:mac_os_x:10.13.6:supplemental_update:*:*:*:*:*:*
Matching versions
Apple » Iphone Os
Versions before (<) 13.5
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Ipados
Versions before (<) 13.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: N/A
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Matching versions
When used together with: Samsung » Galaxy Note8 » Version: N/A
When used together with: Samsung » Galaxy S8 » Version: N/A
When used together with: Samsung » Galaxy S8 Plus » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-6616

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-6616

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:A/AC:L/Au:N/C:N/I:P/A:N	6.5	2.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

References for CVE-2020-6616

https://media.ccc.de/v/DiVOC-6-finding_eastereggs_in_broadcom_s_bluetooth_random_number_generator

media.ccc.de - Finding Eastereggs in Broadcom's Bluetooth Random Number Generator
Exploit;Third Party Advisory
https://github.com/seemoo-lab/internalblue/blob/master/doc/rng.md

internalblue/rng.md at master · seemoo-lab/internalblue · GitHub
Third Party Advisory
https://support.apple.com/kb/HT211168

About the security content of iOS 13.5 and iPadOS 13.5 - Apple Support
Third Party Advisory

CVEs referencing this url
https://security.samsungmobile.com/securityUpdate.smsb

Android Security Updates Details | Samsung Mobile Security
Vendor Advisory

CVEs referencing this url
https://twitter.com/naehrdine/status/1255980443368919045

Jiska on Twitter: "The Samsung Galaxy S8 Bluetooth chip is missing a hardware random number generator and the pseudo random number generator fallback is weak. The S8 is still in Samsung's monthly patc
Third Party Advisory
http://bluetooth.lol

Third Party Advisory
https://support.apple.com/HT211168

About the security content of iOS 13.5 and iPadOS 13.5 - Apple Support
Third Party Advisory

CVEs referencing this url
https://support.apple.com/kb/HT211100

About the security content of macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra - Apple Support
Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2020/May/49

Full Disclosure: APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5
Mailing List;Third Party Advisory

CVEs referencing this url
https://twitter.com/naehrdine/status/1255981245147877377

Jiska on Twitter: "Broadcom did not provide us with any patches in advance, so we have no idea how they will fix this issue. Also, after our initial report of CVE-2020-6616, they claimed that the PRNG
Third Party Advisory

Jump to

Vulnerability Details : CVE-2020-6616

Products affected by CVE-2020-6616

Exploit prediction scoring system (EPSS) score for CVE-2020-6616

CVSS scores for CVE-2020-6616

References for CVE-2020-6616