[PATCH] Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical

[PATCH] Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical

[Chun-Yi Lee]

The 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys
are identical") patch be introduced since v5.13. Looks this patch can
handle the CVE-2021-37577 issue. However, it only checks if the full
64-byte public key (X and Y coordinates) is identical, which is
insufficient.

In CVE-2021-37577:
Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple
Pairing using the Passkey entry protocol in Bluetooth Core
Specifications 2.1 through 5.3 may permit an unauthenticated
man-in-the-middle attacker to identify the Passkey used during pairing
by reflection of a crafted public key with the same X coordinate as the
offered public key and by reflection of the authentication evidence of
the initiating device, potentially permitting this attacker to complete
authenticated pairing with the responding device using the correct
Passkey for the pairing session. This is a related issue to
CVE-2020-26558.

And base on spec, the remote and local public key should not have
the same X coordinate:

Bluetooth Core Specification Version: v5.4
(7.1 PHASE 1: PUBLIC KEY EXCHANGE)
"If the two public keys have the same X coordinate and neither is the
debug key (see [Vol 4] Part E, Section 7.6.4), each device should fail
the pairing process."

Bluetooth Core Specification Version: v6.0
(7.1 Phase 1: Public key exchange)
"If the two public keys have the same X coordinate and neither is the
debug key (see [Vol 4] Part E, Section 7.6.4), each device shall fail
the pairing process."

Update the check in smp_cmd_public_key() to only compare the 32-byte X
coordinate of the public keys, making the validation strictly compliant
with the specification and effectively mitigating CVE-2021-37577.

Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")
Link: https://nvd.nist.gov/vuln/detail/cve-2021-37577
Signed-off-by: Chun-Yi Lee <jlee@suse.com>
---
 net/bluetooth/smp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 2df303f6a38f..80128b31e631 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2734,7 +2734,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
 	 * not in use.
 	 */
 	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
-	    !crypto_memneq(key, smp->local_pk, 64)) {
+	    !crypto_memneq(key, smp->local_pk, 32)) {
 		bt_dev_err(hdev, "Remote and local public keys are identical");
 		return SMP_DHKEY_CHECK_FAILED;
 	}
-- 
2.51.0

RE: Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2460 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1190369/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.55 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.27 seconds
SubjectPrefix                 PASS      0.10 seconds
BuildKernel                   PASS      19.28 seconds
CheckAllWarning               PASS      22.70 seconds
CheckSparse                   PASS      24.06 seconds
BuildKernel32                 PASS      19.64 seconds
CheckKernelLLVM               PASS      20.36 seconds
TestRunnerSetup               PASS      431.11 seconds
TestRunner_smp-tester         PASS      7.00 seconds
IncrementalBuild              PASS      19.39 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical
ERROR: Please use git commit description style 'commit <12+ chars of sha1> ("<title line>")' - ie: 'commit 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")'
#120: 
The 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys

WARNING: From:/Signed-off-by: email address mismatch: 'From: Chun-Yi Lee <joeyli.kernel@gmail.com>' != 'Signed-off-by: Chun-Yi Lee <jlee@suse.com>'

total: 1 errors, 1 warnings, 0 checks, 8 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14904963.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical

1: T1 Title exceeds max length (86>80): "Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical"


https://github.com/bluez/bluetooth-next/pull/972

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical

[Luiz Augusto von Dentz]

Hi Chun-Yi,

On Wed, Oct 21, 2026 at 5:35 AM Chun-Yi Lee <joeyli.kernel@gmail.com> wrote:
>
> The 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys
> are identical") patch be introduced since v5.13. Looks this patch can
> handle the CVE-2021-37577 issue. However, it only checks if the full
> 64-byte public key (X and Y coordinates) is identical, which is
> insufficient.
>
> In CVE-2021-37577:
> Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple
> Pairing using the Passkey entry protocol in Bluetooth Core
> Specifications 2.1 through 5.3 may permit an unauthenticated
> man-in-the-middle attacker to identify the Passkey used during pairing
> by reflection of a crafted public key with the same X coordinate as the
> offered public key and by reflection of the authentication evidence of
> the initiating device, potentially permitting this attacker to complete
> authenticated pairing with the responding device using the correct
> Passkey for the pairing session. This is a related issue to
> CVE-2020-26558.
>
> And base on spec, the remote and local public key should not have
> the same X coordinate:
>
> Bluetooth Core Specification Version: v5.4
> (7.1 PHASE 1: PUBLIC KEY EXCHANGE)
> "If the two public keys have the same X coordinate and neither is the
> debug key (see [Vol 4] Part E, Section 7.6.4), each device should fail
> the pairing process."
>
> Bluetooth Core Specification Version: v6.0
> (7.1 Phase 1: Public key exchange)
> "If the two public keys have the same X coordinate and neither is the
> debug key (see [Vol 4] Part E, Section 7.6.4), each device shall fail
> the pairing process."
>
> Update the check in smp_cmd_public_key() to only compare the 32-byte X
> coordinate of the public keys, making the validation strictly compliant
> with the specification and effectively mitigating CVE-2021-37577.
>
> Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")
> Link: https://nvd.nist.gov/vuln/detail/cve-2021-37577
> Signed-off-by: Chun-Yi Lee <jlee@suse.com>
> ---
>  net/bluetooth/smp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> index 2df303f6a38f..80128b31e631 100644
> --- a/net/bluetooth/smp.c
> +++ b/net/bluetooth/smp.c
> @@ -2734,7 +2734,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
>          * not in use.
>          */
>         if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
> -           !crypto_memneq(key, smp->local_pk, 64)) {
> +           !crypto_memneq(key, smp->local_pk, 32)) {
>                 bt_dev_err(hdev, "Remote and local public keys are identical");
>                 return SMP_DHKEY_CHECK_FAILED;
>         }
> --
> 2.51.0

Sashiko is flagging a problem:

https://sashiko.dev/#/patchset/20261021093522.3536051-1-jlee%40suse.com

That said I do wonder if the check is only truly valid as an
initiator, since as a responder, this could be checked before
responding in the unlikely event that the X coordinate happens to be
the exact same as the initiator's (if that is even possible).


-- 
Luiz Augusto von Dentz

Re: [PATCH] Bluetooth: SMP: Fail if the X coordinate of remote and local public keys are identical

[joeyli]

Hi Luiz, 

Thanks for your review!

On Wed, Oct 21, 2026 at 10:00:41AM -0400, Luiz Augusto von Dentz wrote:
> Hi Chun-Yi,
> 
> On Wed, Oct 21, 2026 at 5:35 AM Chun-Yi Lee <joeyli.kernel@gmail.com> wrote:
> >
> > The 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys
> > are identical") patch be introduced since v5.13. Looks this patch can
> > handle the CVE-2021-37577 issue. However, it only checks if the full
> > 64-byte public key (X and Y coordinates) is identical, which is
> > insufficient.
> >
> > In CVE-2021-37577:
> > Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple
> > Pairing using the Passkey entry protocol in Bluetooth Core
> > Specifications 2.1 through 5.3 may permit an unauthenticated
> > man-in-the-middle attacker to identify the Passkey used during pairing
> > by reflection of a crafted public key with the same X coordinate as the
> > offered public key and by reflection of the authentication evidence of
> > the initiating device, potentially permitting this attacker to complete
> > authenticated pairing with the responding device using the correct
> > Passkey for the pairing session. This is a related issue to
> > CVE-2020-26558.
> >
> > And base on spec, the remote and local public key should not have
> > the same X coordinate:
> >
> > Bluetooth Core Specification Version: v5.4
> > (7.1 PHASE 1: PUBLIC KEY EXCHANGE)
> > "If the two public keys have the same X coordinate and neither is the
> > debug key (see [Vol 4] Part E, Section 7.6.4), each device should fail
> > the pairing process."
> >
> > Bluetooth Core Specification Version: v6.0
> > (7.1 Phase 1: Public key exchange)
> > "If the two public keys have the same X coordinate and neither is the
> > debug key (see [Vol 4] Part E, Section 7.6.4), each device shall fail
> > the pairing process."
> >
> > Update the check in smp_cmd_public_key() to only compare the 32-byte X
> > coordinate of the public keys, making the validation strictly compliant
> > with the specification and effectively mitigating CVE-2021-37577.
> >
> > Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")
> > Link: https://nvd.nist.gov/vuln/detail/cve-2021-37577
> > Signed-off-by: Chun-Yi Lee <jlee@suse.com>
> > ---
> >  net/bluetooth/smp.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> > index 2df303f6a38f..80128b31e631 100644
> > --- a/net/bluetooth/smp.c
> > +++ b/net/bluetooth/smp.c
> > @@ -2734,7 +2734,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
> >          * not in use.
> >          */
> >         if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
> > -           !crypto_memneq(key, smp->local_pk, 64)) {
> > +           !crypto_memneq(key, smp->local_pk, 32)) {
> >                 bt_dev_err(hdev, "Remote and local public keys are identical");
> >                 return SMP_DHKEY_CHECK_FAILED;
> >         }
> > --
> > 2.51.0
> 
> Sashiko is flagging a problem:
> 
> https://sashiko.dev/#/patchset/20261021093522.3536051-1-jlee%40suse.com

Thanks for your reminder! I will fix it.

> 
> That said I do wonder if the check is only truly valid as an
> initiator, since as a responder, this could be checked before
> responding in the unlikely event that the X coordinate happens to be
> the exact same as the initiator's (if that is even possible).
>

Honestly I'm not familiar with Bluetooth. How about the following change?
It also checks local pk before Responsor sends public key to
Initiator:

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 80128b31e631..d1786e398128 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1889,6 +1889,16 @@ static u8 sc_send_public_key(struct smp_chan *smp)
        }
 
 done:
+       /* Check if remote and local public keys are the same and debug key is
+        * not in use.
+        */
+       if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
+           !test_bit(SMP_FLAG_INITIATOR, &smp->flags) &&
+           !crypto_memneq(smp->remote_pk, smp->local_pk, 32)) {
+               bt_dev_err(hdev, "Remote and local public keys are identical");
+               return SMP_DHKEY_CHECK_FAILED;
+       }
+
        SMP_DBG("Local Public Key X: %32phN", smp->local_pk);
        SMP_DBG("Local Public Key Y: %32phN", smp->local_pk + 32);
 
@@ -2734,6 +2744,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
         * not in use.
         */
        if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
+           test_bit(SMP_FLAG_INITIATOR, &smp->flags) &&
            !crypto_memneq(key, smp->local_pk, 32)) {
                bt_dev_err(hdev, "Remote and local public keys are identical");
                return SMP_DHKEY_CHECK_FAILED;

Thanks a lot! 
Joey Lee