CVE-2018-5383

Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange

State: Published
Severity: 8.0 High
Published: Aug 7, 2018
Updated: Sep 16, 2024
Reserved: Jan 12, 2018

Description

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Scores

CVSS	Score	Vector	Source
3.0	8.0 High	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N	certcc

Weaknesses

CWE-325

Affected Products

Product	Versions
macOSApple	10.13 High Sierra to before 10.13.6Affected
iOSApple	11 to before 11.4Affected
AndroidAndroid Open Source Project	before 2018-06-05 patch levelAffected

References

http://www.cs.technion.ac.il/~biham/BT/
1041432vdb-entry
VU#304725third-party-advisory
https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update
104879vdb-entry
[debian-lts-announce] 20190402 [SECURITY] [DLA 1747-1] firmware-nonfree security updatemailing-list
RHSA-2019:2169vendor-advisory
USN-4094-1vendor-advisory
USN-4095-2vendor-advisory
USN-4095-1vendor-advisory
USN-4118-1vendor-advisory
USN-4351-1vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.