Inquiry regarding BLURtooth

[saigal_a]

Hi,

I have come across the CVE vulnerability CVE-2020-15802 (https://kb.cert.org/vuls/id/589825), named as BLURtooth or BLUR attacks. These attacks target the Cross-transport key derivation (CTKD) security mechanism in the Bluetooth standard.

Is there any information whether this affects the nRF5 SDK and whether it has been fixed in any specific release of the SDK?

Thanks in advance.

Regards,
Saigal

[Einar Thorsrud]

Hi Saigal,

CVE-2020-15802 is only relevatn for devices that support BR/EDR (Bluetooth classic) as well as BLE, so it does not apply to any Nordic products.

Einar

[saigal_a]

Hi Einar,

Thank you for the confirmation.