Espressif ESP-IDF Bluetooth Stack Connection State Spoofing Fix

Vulnerability Information Overview Affected and Patched Versions Bluetooth Stack (ESP-IDF) - Affected Versions: - v5.5.1 - v5.4.2 - v5.3.4 - v5.2.5 - v5.1.6 - Patched Versions: - v5.5.2 (pending release) - v5.4.3 - v5.3.5 (pending release) - v5.2.6 - v5.1.7 (pending release) Vulnerability Details Description When an ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of or , advertising may unexpectedly stop. At this point, the controller may incorrectly report a connection event to the host, causing the application layer to mistakenly believe that a connection has been successfully established. Impact In affected ESP32 software versions, the controller fails to properly handle connection requests associated with invalid Access Addresses or : Advertising stops unexpectedly. Connection events are incorrectly reported to the host. The invalid AA is later detected and ignored, but no error or disconnection event is propagated to the application layer. As a result, the application layer may continue to believe the device is connected, even though no valid connection exists. This issue affects only the ESP32 series; other Espressif chip families (such as ESP32-C, ESP32-S, and ESP32-H) are not affected. Resolution According to the Bluetooth LE specification (Core Specification, Volume 6, Part B), Access Addresses and are explicitly defined as invalid. Any device that transmits packets or initiates connections using these values is incompatible with the Bluetooth LE specification. After this fix, when an ESP32 is in advertising mode and receives a connection request using Access Address or , the request will be ignored, in compliance with the Bluetooth LE specification: Advertising continues uninterrupted. No invalid connection is established. Application layer behavior remains consistent with protocol expectations. Fix Commit Records The following commits resolve this issue: master: release/v5.5: release/v5.4: release/v5.3: release/v5.2: release/v5.1: Contributor Acknowledgement We thank Dominik Schreiber from SBA Research for reporting this vulnerability and overseeing its disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Espressif ESP-IDF Bluetooth Stack Connection State Spoofing Fix

More from this source