CVE-2020-6616

MEDIUM

Android - Bluetooth Spoofing via Low-Entropy PRNG in Broadcom Chips

Title source: llm
STIX 2.1

Description

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situations where a Hardware Random Number Generator (HRNG) should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset. The Samsung ID is SVE-2020-16882 (May 2020).

References (10)

Core 10
Core References
Vendor Advisory x_refsource_confirm
https://security.samsungmobile.com/securityUpdate.smsb
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT211100
Third Party Advisory x_refsource_misc
http://bluetooth.lol
Third Party Advisory x_refsource_misc
https://twitter.com/naehrdine/status/1255981245147877377
Third Party Advisory x_refsource_misc
https://twitter.com/naehrdine/status/1255980443368919045
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT211168
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/May/49
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT211168

Scores

CVSS v3 6.5
EPSS 0.0073
EPSS Percentile 50.2%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

Status published
Products (6)
apple/ipados < 13.5
apple/iphone_os < 13.5
apple/mac_os_x 10.13.6 security_update_2018-002 (11 CPE variants)
apple/mac_os_x 10.14.6 security_update_2019-001 (9 CPE variants)
apple/mac_os_x 10.13.0 - 10.13.6
google/android
Published May 08, 2020
Tracked Since Feb 18, 2026