Security News > 2021 > June > Zephyr OS Bluetooth vulnerabilities left smart devices open to attack

Vulnerabilities in the Zephyr real-time operating system's Bluetooth stack have been identified, leaving a wide variety of Internet of Things devices open to attack - unless upgraded to a patched version of the OS. A security advisory released by Synopsys this afternoon highlights eight key vulnerabilities in Zephyr's Bluetooth Low Energy software stack.

The vulnerabilities, discovered through use of Synopsys's Defensics fuzzing software, are exploitable when the devices are in advertising mode and accepting connections from remote devices - putting a wide range of gadgets at risk.

"Typically, the Bluetooth Low Energy range is up to 100 metres. However, Bluetooth LE long-range mode, which was introduced in the Bluetooth 5 specification, may provide a range of up to 1km.".

"Zephyr has done a great job defining their security policy which ensures they provide security updates to their LTS releases and for the two latest non-LTS releases. Zephyr project members using Zephyr in their products also receive security alerts before the vulnerabilities are disclosed publicly."

"Many of us simply connect to devices assuming Bluetooth, or wireless connectivity in general, is an effortless and secure way to link devices but software vulnerabilities can lead to problems such as eavesdropping, denial of service, or even malware."

"Unpatched security holes could potentially create havoc with a Bluetooth device and updates often go amiss in the updating process around the home or office. Luckily, Bluetooth attacks require the malicious actor to be just a few feet away which is rather uncommon compared to other more sophisticated remote attacks which often create more destruction."

News URL

https://go.theregister.com/feed/www.theregister.com/2021/06/22/zephyr_os_bluetooth_vulnerabilities/