Uploaded image for project: 'Embedded Software & Tools'
  1. Embedded Software & Tools
  2. EXT_EP-11608

[PSIRT] Stack generates unexpected RPA during fuzz attack when using speed optimization

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Urgent Urgent
    • SimpleLink Lowpower SDK F3 BLE5 Stack
    • BLE_LOKI-1161
    • BLE Stack BLE5-3.2.4 RC3
    • Hide
      BLE Stack BLE5-3.3.1 RC1
      BLE Stack BLE5-3.3.1
      Show
      BLE Stack BLE5-3.3.1 RC1 BLE Stack BLE5-3.3.1
    • CC23xx

      Description of issue: In some cases, during a fuzz attack, device will end-up generating non-resolvable RPA even though the setting is resolvable RPA. This will lead to phone not able to connect to our device and users being locked out until the next valid RPA comes (15 mins by default). Behavior is observed with pairing mode is set to "Waiting to initiate" and when optimization is configured for speed over size.

      Steps to reproduce issue: Defensics test case # SMP legacy 1001, loop.
      multirole setting:

      • change pairing mode to wait for initiate.
      • change optimization to speed instead of size

      During the fuzz attack, the crypto wasn't able to decrypt some of the packets and leads to link termination with MIC_error which then triggers RPA changing.
      However, at this point crypto isn't ready to restart generate hash for RPA so it returns AESECB_STATUS_ERROR under AESECB_startOperation function. Stack has no check on the crypto status and just used invalid hash for the RPA which results in RPA being non-resolvable.

            syncuser TI User
            syncuser TI User
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: