CVE-2019-9506: Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
Modified
AliasesRHSA-2019:3165RHSA-2019:3187RHSA-2019:3218RHSA-2019:3231RHSA-2020:1460UBUNTU-CVE-2019-9506DEBIAN-CVE-2019-9506
Published 14-08-2019Last modified 16-09-2024
Vulnerability summary
CVE-2019-9506 is a high (CVSS 8.1) Cryptographic Issues vulnerability in apple iphone_os. EPSS estimates a 2.69% chance of exploitation in the next 30 days, higher than 85.9% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 7.6, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
2.69%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 29 · Related 18DLA-1919-1DLA-1930-1OPENSUSE-SU-2019:2307-1OPENSUSE-SU-2019:2308-1RHSA-2019:2975RHSA-2019:3055RHSA-2019:3076RHSA-2019:3089RHSA-2019:3217RHSA-2019:3220RHSA-2019:3309RHSA-2019:3517RHSA-2020:0204SUSE-SU-2019:2648-1SUSE-SU-2019:2651-1SUSE-SU-2019:2658-1SUSE-SU-2019:2706-1SUSE-SU-2019:2710-1SUSE-SU-2019:2756-1SUSE-SU-2019:2879-1SUSE-SU-2019:2949-1SUSE-SU-2019:2950-1SUSE-SU-2019:2984-1SUSE-SU-2019:3200-1SUSE-SU-2019:3295-1SUSE-SU-2020:0093-1USN-4115-1USN-4118-1USN-4147-1
Timeline
- 14-08-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.
CVSS metrics
9 scores · 5 sources · 4 versionsLow 2.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
High 7.6Preferred score · CVE.org (CNA)
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LSources4 sources · 7.0–7.6
- OSV · Red hatEcosystem advisory · calculated7.0HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.6HighCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- NVDNIST7.6HighCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Medium 4.8Preferred score · NVD (NIST)
AV:A/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.69%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.69% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.
Affected systems
Version check
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Huawei126 products
- alp-al00b_firmware< 9.1.0.333\(c00e333r2p1t8\)
- ares-al00b_firmware< 9.1.0.160\(c00e160r2p5t8\)
- ares-al10d_firmware< 9.1.0.160\(c00e160r2p5t8\)
- ares-tl00c_firmware< 9.1.0.165\(c01e165r2p5t8\)
- asoka-al00ax_firmware< 9.1.1.181\(c00e48r6p1\)
Redhat38 products
- enterprise_linux8.0
- enterprise_linux_aus7.5
- enterprise_linux_eus7.6 | 7.7 | 8.1 | 8.2 | 8.4
- enterprise_linux_for_real_time7 | 8
- enterprise_linux_for_real_time_eus8.2 | 8.4
Ubuntu26 products
- linuxAll versions (No fix recorded) | < 4.4.0-159.187 | < 4.15.0-60.67
- linux-aws< 4.4.0-1054.58 | < 4.4.0-1090.101 | < 4.15.0-1047.49
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-aws-hwe< 4.15.0-1047.49~16.04.1
- linux-azure< 4.15.0-1059.64~14.04.1
Debian2 products
- linux< 5.2.6-1
- debian_linuxEOL8.0
Bluetooth1 product
- br/edr5.1
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Google1 product
- androidna
Opensuse1 product
- leapEOL15.0 | 15.1
9 vendors · 200 products · Showing 200 of 213
References
48 links- www.usenix.org/conference/usenixsecurity19/presentation/antonioliX Refsource MISCREPORTThird Party Advisory
- www.bluetooth.com/security/statement-key-negotiation-of-bluetooth/X Refsource CONFIRMREPORTThird Party Advisory
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20190828-01-knob-enX Refsource CONFIRMThird Party Advisory
Show all 48 references
lists.debian.org/debian-lts-announce/2019/09/msg00014.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2019/09/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3187Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3165Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3231Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3218Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- knobattack.comREPORT