Inquiry Regarding BLUFFS CVE Vulnerability

[Niteen]

Hi,

My name is Niteen Borge, and I am reaching out from Imprivata Inc. We currently use Nordic products in our systems, and we are inquiring about their vulnerability status to the new CVE "BLUFFS." (https://nvd.nist.gov/vuln/detail/CVE-2023-24023).

The Bluetooth model is nRF52840-CKAA. Could you please provide information on whether Nordic products are affected by this CVE? Additionally, if there are any recommended actions or updates to address this vulnerability, I would greatly appreciate your guidance.

Thank you for your assistance, and I look forward to hearing from you soon.

Best regards,

Niteen

[Turbo J]

If you used the same security (key len) values from the SDK examples, you will be vulnerable. These set the min key strength to 7 for maximum interoperability (and compatibility with international laws).

Your developer is free to set the value to 16 in your custom firmware which would fix the issue AFAIK. Using unmodified example code is not advisable in any case.

[Hung Bui]

Hi Niteen, 

I'm waiting for the official answer from our Product Security team but from what I can find in the description of the vulnerability, it should only affect Bluetooth BR/EDR devices, meaning Bluetooth Classic not Bluetooth Low Energy (BLE). 

So it would not be relevant for our products. 

[Hung Bui]

Hi Niteen, 
We got the confirmation from our Security team that the vulnerability doesn't impact Bluetooth Low Energy and only relevant to Bluetooth Classic (BR/EDR). 

Please see the official Bluetooth SIG Statement for more details https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/