文档 • 安装 • 使用 • 漏洞利用 • 硬件 • 待办事项 • 汽车评估 • 蓝牙资源 • 许可证
BlueToolkit 是一个模块化的黑盒蓝牙安全测试框架，适用于经典蓝牙（BR/EDR）和低功耗蓝牙（BLE）。它支持半自动化测试，并包含三个主要模块：
我们在来自不同厂商（奥迪、宝马、雪佛兰、本田、现代、奔驰、Mini、欧宝、极星、雷诺、斯柯达、丰田、大众、特斯拉）的 22 辆汽车上评估了 BlueToolkit，并发现了 128 个漏洞。
此外，我们展示了如何在已建立的连接或处于中间人（MitM）位置时，通过 MAP 劫持在线账户。
这项工作促成了一篇被 WOOT 25' 接收的研究论文：当我们有链接时再补充
BlueToolkit 可以安装在裸机 Ubuntu/Debian 系统（推荐）上，或使用虚拟机安装。两种情况下，安装程序都会提示安装 Braktooth 和 BluetoothAssistant 的特定模块，这些模块需要特定硬件设备可用并已插入。也可以重新运行安装程序来单独安装独立模块。
先决条件：
安装后：
* 你需要允许虚拟机通过 USB 访问蓝牙模块或额外硬件，为此你需要执行以下操作：
* USB 支持已开启，因此打开 VirtualBox
* 找到正在运行的虚拟机，然后点击“显示”
* 点击“设备”->“USB”
* 你将会看到多个可以为虚拟机开启的设备
* 勾选你需要的任何设备（蓝牙模块、硬件、手机），或者勾选所有设备以确保万无一失。
</details>
### 用法
运行 `bluekit -h` 以显示 BlueToolkit 的使用信息：```console
usage: bluekit [-h] [-t TARGET] [-l] [-c] [-ct] [-ch] [-v VERBOSITY] [-ex EXCLUDEEXPLOITS [EXCLUDEEXPLOITS ...]] [-e EXPLOITS [EXPLOITS ...]] [-r] [-re] [-rej] [-hh HARDWARE [HARDWARE ...]] ...
positional arguments:
rest
options:
-h, --help show this help message and exit
-t TARGET, --target TARGET
target MAC address
-l, --listexploits List exploits or not
-c, --checksetup Check whether Braktooth is available and setup
-ct, --checktarget Check connectivity and availability of the target
-ch, --checkpoint Start from a checkpoint
-v VERBOSITY, --verbosity VERBOSITY
Verbosity level
-ex EXCLUDEEXPLOITS [EXCLUDEEXPLOITS ...], --excludeexploits EXCLUDEEXPLOITS [EXCLUDEEXPLOITS ...]
Exclude exploits, example --exclude exploit1, exploit2
-e EXPLOITS [EXPLOITS ...], --exploits EXPLOITS [EXPLOITS ...]
Scan only for provided --exploits exploit1, exploit2; --exclude is not taken into account
-r, --recon Run a recon script
-re, --report Create a report for a target device
-rej, --reportjson Create a report for a target device
-hh HARDWARE [HARDWARE ...], --hardware HARDWARE [HARDWARE ...]
Scan only for provided exploits based on hardware --hardware hardware1 hardware2; --exclude and --exploit are not taken into account
一些用法示例：
列出所有可用漏洞利用（无需 root 权限）：
bluekit -l
运行侦察：
sudo bluekit -t AA:BB:CC:DD:EE:FF -r
测试连接：
sudo bluekit -t AA:BB:CC:DD:EE:FF -ct
测试一个或多个漏洞利用（以空格分隔）：
sudo bluekit -t AA:BB:CC:DD:EE:FF -e invalid_max_slot au_rand_flooding internalblue_knob
更多文档可在我们的 wiki中查看
某些攻击需要特定硬件：
BlueToolkit 会自动下载所有漏洞和硬件模板。BlueToolkit templates 仓库提供了可直接使用的模板完整列表。 此外，您可以按照 BlueToolkit 的模板编写指南编写自己的模板和检查项，并添加新硬件。 YAML 参考语法可在此处获取。
我们以 “Awesome Bluetooth Security” 的方式收集并分类了蓝牙漏洞。我们使用了以下来源——ACM、IEEE SP、Blackhat、DEFCON、Car Hacking Village、NDSS 和 Google Scholars。在 Google、Baidu、Yandex、Bing 等搜索引擎中搜索了以下关键词——Bluetooth security toolkit、Bluetooth exploits github、Bluetooth security framework、bluetooth pentesting toolkit。我们还根据以下参数解析了所有 GitHub 仓库——topic:bluetooth topic:exploit、topic:bluetooth topic:security。
如需手动攻击，请参阅文档。
| 漏洞 | 类别 | 类型 | 验证类型 | 硬件要求 | 已测试 |
|---|---|---|---|---|---|
| 始终可配对 | 链式 | 链式 | 手动 | ✓ | |
| 仅车辆可以发起连接 | 链式 | 链式 | 手动 | ✓ | |
| 快速重启 | 链式 | 链式 | 手动 | ✓ | |
| 不支持 SC | 链式 | 信息 | 自动 | ✓ | |
| 可能的 BLUR 检查 | 链式 | 信息 | 自动 | ✓ | |
| 我的名字是键盘 | 严重 | RCE | 半自动 | ✓ | |
| CVE-2017-0785 | 严重 | 内存泄漏 | 自动 | ✓ | |
| CVE-2018-19860 | 严重 | 内存执行 | 自动 | ✓ | |
| V13 无效的最大时隙类型 | DoS | DoS | 自动 | ✓ | ✓ |
| V3 重复的 IOCAP | DoS | DoS | 自动 | ✓ | ✓ |
| NiNo 检查 | MitM | MitM | 半自动 | ✓ | |
| 使用传统配对 | MitM | MitM | 自动 | ✓ | |
| KNOB | MitM | MiTM | 半自动 | ✓ | ✓ |
这些攻击是新颖的，且已由该框架测试
| 漏洞 | 类别 | 类型 | 验证类型 | 硬件要求 | 已测试 |
|---|---|---|---|---|---|
| 不安全的 NC 实现 | MitM | MitM | 手动 | ✓ | |
| 车载 NiNo | MitM | 信息 | 手动 | ✓ | |
| 联系人提取器 | 严重 | BAC | 手动 | ✓ |
| 漏洞 | 类别 | 类型 | 验证类型 | 硬件要求 | 已测试 | 计划添加 |
|---|---|---|---|---|---|---|
| BLUR | MitM | ? | - | ✓ | ✓ | |
| BIAS | MitM | ? | - | ✓ | ✓ | |
| BLUFFS | MitM | ? | - | ✓ | ✓ | |
| BlueRepli | 严重 | BAC | - | |||
| CVE-2020-26555 | MitM | MiTM | - |
此外，我们还发现了以下蓝牙经典（Bluetooth Classic）和低功耗蓝牙（BLE）漏洞。下表包含有关攻击和漏洞的以下信息——名称、类型（实现特定、协议特定或影响 BT 配置文件）、蓝牙类型（BLE、BT、BT + BLE）、受影响的 BT 版本、漏洞利用数量、发布年份、CVE（如有）、CVSS（如有）、所需硬件（如有）、概念验证（如有），以及注释部分中的附加信息（含更多链接或说明）。| 利用家族 | 名称 | 类型 | BT 类型 | BT 版本 | 利用 # | 年份 | CVE | CVSS | 硬件 | PoC | 链接 | 备注 | | -------------- | ----------------------------------- | ----- | ---------- | ------------------ | --------------- | ---- | -------------------------------------------------------------------- | ---- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Qualcomm WSA8835 attck | Imp | BLE | | 1 | 2023 | | | | | https://www.cvedetails.com/cve/CVE-2023-21647/?q=CVE-2023-21647 | GATT 数据包验证不当 | | | 认证绕过、欺骗 | Imp | BLE | | 1 | 2022 | | | | | https://fmsh-seclab.github.io/ | 特斯拉钥匙中通过欺骗绕过认证 | | | unauth MITM | Prot | BLE | 4.0 - 5.3 | 1 | 2022 | | | | | https://www.cvedetails.com/cve/CVE-2022-25836/ | 查看 CVE 了解详情，依赖于方法混淆 | | | BLE 接近认证中继 | Rel | BLE | 4.0 - 5.3 | 1 | 2022 | | | | | https://research.nccgroup.com/2022/05/15/technical-advisory-tesla-ble-phone-as-a-key-passive-entry-vulnerable-to-relay-attacks/ | BLE 接近认证易受中继攻击 | | | Sniffle | Snif | BLE | 4.0-5.0 | 1 | 2022 | | | TI CC1352/CC26x2 | https://github.com/nccgroup/Sniffle | | | | | InjectaBLE | Prot | BLE | 4.0 - 5.2 | 1 | 2021 | | | nRF52840 | https://github.com/RCayre/injectable-firmware | https://hal.laas.fr/hal-03193297v2/document | MITM，发送恶意数据包，在会话建立/被劫持后进行后渗透（针对特定实现和型号） | | | jacknimble | Imp | BLE | | | 2020 | | | nRF52840 | https://github.com/darkmentorllc/jackbnimble | https://i.blackhat.com/USA-20/Wednesday/us-20-Kovah-Finding-New-Bluetooth-Low-Energy-Exploits-Via-Reverse-Engineering-Multiple-Vendors-Firmwares.pdf | 针对特定硬件的 3 个利用，CVE-2020-15531 | | | SweynTooth | Imp | BLE | | 12 | 2020 | | | nRF52840 | https://github.com/Matheus-Garbelini/sweyntooth_bluetooth_low_energy_attacks | https://asset-group.github.io/disclosures/sweyntooth/ | | | | BlueDoor | Prot | BLE | 4.0 - 5.2 | 1 | 2020 | | | nRF51822 | | http://tns.thss.tsinghua.edu.cn/~jiliang/publications/MOBISYS2020_BlueDoor.pdf | 中间人攻击 | | | 降级攻击 | Prot | BLE | 4.2 - 5.0 | 1 | 2020 | | | TICC2640 & Adafruit Bluefruit LE Sniffe | | https://www.usenix.org/system/files/sec20-zhang-yue.pdf | 通过降级的 MITM（SCO）CVE-2020-35473 | | | BLESA | Spoof | BLE | | 1 | 2020 | | | | | https://www.usenix.org/system/files/woot20-paper-wu.pdf | 欺骗以建立 MITM 并禁用加密 | | SweynTooth | Cypress PSoc 4 BLE | Imp | BLE | | 1 | 2019 | | | | | https://www.cvedetails.com/cve/CVE-2019-16336/?q=CVE-2019-16336 | 拒绝服务 | | SweynTooth | Cypress PSoc 4 BLE | Imp | BLE | | 1 | 2019 | | | | | https://www.cvedetails.com/cve/CVE-2019-17061/?q=CVE-2019-17061 | 缓冲区溢出 | | SweynTooth | NXP KW41Z up to 2.2.1 | Imp | BLE | | 1 | 2019 | | | | | https://www.cvedetails.com/cve/CVE-2019-17060/?q=CVE-2019-17060 | BLE 链路层缓冲区溢出 | | SweynTooth | STMicroelectronics BLE Stack | Imp | BLE | | 1 | 2019 | | | | | https://www.cvedetails.com/cve/CVE-2019-19192/?q=CVE-2019-19192 | STM32WB5x 设备上 1.3.1 及之前版本在接收时未正确处理连续的 ATT 请求 | | | 同驻应用 BLE | | BLE | | 1 | 2019 | | | | 理论 | https://www.usenix.org/system/files/sec19-sivakumaran_0.pdf | 同驻应用可获取 BLE 数据，从而窃取所需信息？？？能否用它进行中继？ | | | BleedingBit | Imp | BLE | 4.2 - 5.0 | 1 | 2018 | | | | | https://www.armis.com/research/bleedingbit/ | | | | GATTacking | Prot | BLE | 4.0 | 1 | 2016 | | | 基于 CSR 8510 的 USB 适配器 | https://github.com/securing/gattacker | https://www.blackhat.com/docs/us-16/materials/us-16-Jasek-GATTacking-Bluetooth-Smart-Devices-Introducing-a-New-BLE-Proxy-Tool.pdf | BLE 中间人攻击 | | | Crackle | Prot | BLE | 4 | 1 | 2013 | | | | https://github.com/mikeryan/crackle | https://www.usenix.org/system/files/conference/woot13/woot13-ryan.pdf | 破解 BLE 加密 | | Bluez | MynameIsKeyboard | Imp | BT | | 1 | 2023 | CVE-2023-45866 | 8.8 | | https://github.com/marcnewlin/hi_my_name_is_keyboard | - | CVE-2023-45866, CVE-2023-45866, CVE-2023-45866 | | Antonioli | BLUFFS | Prot | BT | 4.2-5.2 | 6 | 2023 | CVE-2023-24023 | 6.8 | CYW920819EVB-02 | https://github.com/francozappa/bluffs | | | | | - | Prot | BT | | 1 | 2022 | | | | | https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9833777 | 跨栈非法访问攻击（形式化方法）+ 其他条目中提及的 CVE-2020-26560 和 CVE-2020-15802 | | | BlackTooth | Prot | BT | | 1 | 2022 | | | CYW920819EVB-02 | | https://dl.acm.org/doi/pdf/10.1145/3548606.3560668 | 1 种新攻击（连接阶段）+ KNOB 及被重用的其他攻击 | | | BLAP | Prot | BT | | 1 | 2022 | | | | 理论 | https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9833575 | 从 HCI 转储中提取链接密钥需要物理接触汽车（仅适用于汽车共享） | | | Blue's Clues | Prot | BT | <=5.3 | | 2022 | CVE-2022-24695 | 4.3 | Ubertooth & USRP B210 SDR | https://github.com/TylerTucker/BluesClues | https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10179358 | CVE-2022-24695 影响隐私，绕过 BT/EDR 的不可发现功能 | | | unauth MITM | Prot | BT | 1.0B-5.3 | 1 | 2022 | CVE-2022-25837 | 7.5 | | | https://www.cvedetails.com/cve/CVE-2022-25837/ | 查看 CVE 了解详情，依赖于方法混淆，CVE-2022-25837 | | Braktooth | BrakTooth | Imp | BT | 3.0 - 5.2 | 16 | 2021 | CVE-2021-28139 | 8.8 | ESP-WROVER-KIT | https://github.com/Matheus-Garbelini/braktooth_esp32_bluetooth_classic_attacks | https://asset-group.github.io/disclosures/braktooth/ | | | | BleedingTooth BadChoice | Imp | BT | 4.2-5.2 | 1 | 2020 | CVE-2020-12352 | 6.5 | | https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq | https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup.html | 信息泄露 | | | BleedingTooth BadKarma | Imp | BT | 5.0 | 1 | 2020 | CVE-2020-12351 | 8.8 | | https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq | https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup.html | BlueZ 基于栈的信息泄露 | | | BleedingTooth BadVibes | Imp | BT | 5.0+ | 1 | 2020 | CVE-2020-24490 | 6.5 | | https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649 | https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup.html | 需要 BT 5.0 或更高版本 | | | Snapdragon Auto CVEs | Imp | BT | | 4 | 2020 | | | | | https://www.cvedetails.com/cve/CVE-2020-3703/?q=CVE-2020-3703 | CVE-2020-11156 Snapdragon Auto，无利用。CVE-2020-11154、CVE-2020-11155、CVE-2020-3703 | | | BlueRepli | Imp | BT | | 1 | 2020 | | | | 目前无利用 | https://i.blackhat.com/USA-20/Wednesday/us-20-Xu-Stealthily-Access-Your-Android-Phones-Bypass-The-Bluetooth-Authentication.pdf | https://github.com/DasSecurity-HatLab/BlueRepli-Plus | | | UberTooth | Snif | BT | ALL | 1 | 2020 | | | Ubertooth | https://github.com/greatscottgadgets/ubertooth | https://ubertooth.readthedocs.io/en/latest/ | 嗅探 | | Antonioli | BIAS | Prot | BT | <=5.0 | 4 | 2019 | CVE-2020-10135 | 5.4 | CYW920819, possibly CYW920819M2EVB-01 | https://github.com/francozappa/bias | https://francozappa.github.io/about-bias/ | CVE-2020-10135 | | | MITM SSP BT 5.0 | Prot | BT | 5 | 1 | 2018 | | | | | https://link.springer.com/article/10.1007/s00779-017-1081-6 | 口令输入关联模式易受中间人攻击 | | BlueBorne | CVE-2017-0785 | Imp | BT | | 1 | 2017 | CVE-2017-0785 | 6.5 | | | | | | BlueBorne | CVE-2017-1000251 | Imp | BT | 5 | 4 | 2017 | CVE-2017-1000251 | 8.0 | | https://github.com/ArmisSecurity/blueborne | https://www.armis.com/research/blueborne/ | | | | Lexus BT Heap Overflow | Imp | BT | | 1 | 2017 | CVE-2020-5551 | 8.8 | | 理论 | https://keenlab.tencent.com/en/2020/03/30/Tencent-Keen-Security-Lab-Experimental-Security-Assessment-on-Lexus-Cars/ | 在 2016 年 10 月至 2019 年 10 月于日本以外生产的 Lexus（LC、LS、NX、RC、RC F）、TOYOTA CAMRY 和 TOYOTA SIENNA 中存在 RCE | | | BlueEar | Snif | BT | ALL | 1 | 2016 | | | Ubertooth (2) | https://github.com/albazrqa/BluEar | https://www.cs.cityu.edu.hk/~jhuan9/papers/blueear16mobisys.pdf | 嗅探，扩展了 Ubertooth 的代码 | | | CVE-2018-19860 | Imp | BT | | 1 | 2014 | CVE-2018-19860 | 8.8 | Nexus 5 (internalblue) | internalblue Nexus 5 示例 | | 针对 Broadcom 芯片 BCM4335C0、BCM43438A1 以及 2012-2014 年间其他一些芯片的实现特定攻击（DoS） | | | NINO MITM attack | Prot | BT | | 2 | 2010 | | | Nexus 5 (internalblue) | 理论 + 来自 internalblue 的 PoC + 类似于方法混淆的简单利用 | https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5374082 | NINO - 无输入无输出（中间人攻击 + 带外中间人攻击）。https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=4401672 | | | 对配对的攻击 | Prot | BT | 2.1 | 1 | 2008 | | | | | https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=ac095564c820f02b2793694018d419ce99279de0 | 中间人攻击，针对 2.1 的攻击 | | | 破解蓝牙 PIN | Brute | BT | | 1 | 2005 | | | | 理论 | https://www.usenix.org/legacy/event/mobisys05/tech/full_papers/shaked/shaked.pdf | 6 | | | 密钥提取 | | BT | 1.0B | 1 | 2001 | | | | | https://link.springer.com/chapter/10.1007/3-540-45353-9_14 | 针对非常老的 1.0B 版本的旧攻击 | | | BadBluetooth | Prot | BT + adj | | 1 | 2019 | | | | 理论 | https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2019-ndss-bluetooth.pdf | 假设过高（已安装恶意应用 + 设备受损） | | BlueMirror | BlueMirror BT Mesh profile brute | Prot | BT Profile | 2.1-5.2 | 1 | 2021 | CVE-2020-26556 | 7.5 | | | | 暴力破解 BT Mesh 1.0 和 1.0.1 中随机性不足的 AuthValue 以完成认证 | | BlueMirror | BlueMirror BT Mesh profile brute 2 | Prot | BT Profile | 2.1-5.2 | 1 | 2021 | CVE-2020-26557 | 7.5 | | | | 通过暴力攻击确定 BT Mesh 1.0 和 1.0.1 中的 AuthValue | | BlueMirror | BlueMirror BT Mesh profile no brute | Prot | BT Profile | 2.1-5.2 | 1 | 2021 | CVE-2020-26559 | 8.8 | | | | Mesh Profile 1.0、1.0.1 中的认证绕过，无需暴力破解即可确定 authvalue 和其他数据 | | BlueMirror | BlueMirror BT Mesh profile | Prot | BT Profile | 1.0B-5.2 | 1 | 2020 | CVE-2020-26560 | 8.1 | | | https://kb.cert.org/vuls/id/799380 | CVE-2020-26560 - Mesh Profile 1.0、1.0.1 中的认证绕过 https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9474325 | | BlueMirror | BlueMirror Legacy pairing | Prot | BT/BLE | 2.1-5.2 | 1 | 2021 | CVE-2020-26555 | 5.4 | | | https://kb.cert.org/vuls/id/799380 | 在不知道 PIN 的情况下完成配对 https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9474325 https://www.ieee-security.org/TC/SP2021/SPW2021/WOOT21/files/woot21-claverie-slides.pdf | | BlueMirror | BlueMirror passkey leak | Prot | BT/BLE | 2.1-5.2 | 1 | 2021 | CVE-2020-26558 | 4.2 | | | | 中间人攻击者可通过公钥反射确定 passkey 值（每次可泄露 1 位 passkey 值） | | Antonioli | BLURTooth | Prot | BT/BLE | 4.2, 5.0, 5.1, 5.2 | 4 | 2020 | CVE-2020-15802 | 5.9 | | https://github.com/francozappa/blur | https://hexhive.epfl.ch/BLURtooth/ | CVE-2020-15802 | | | Fixed Coord. Inv. Attack | Imp | BT/BLE | 2.1-5.2 | 1 | 2019 | CVE-2018-5383 | | Nexus 5 (internalblue) or CY5677 | internalblue Nexus 5 示例 | https://biham.cs.technion.ac.il/BT/ | 利用加密缺陷的中间人攻击（实现/协议攻击）CVE-2018-5383 | | Antonioli | KNOB | Prot | BT/BLE | <=5.0 | 1 | 2019 | CVE-2019-9506 | 8.1 | Nexus 5 (internalblue) | https://github.com/francozappa/knob | https://knobattack.com/ | CVE-2019-9506 | | | Ghost 攻击 | Prot | BT/BLE? | | 2 | 2023 | | | | | https://www.ndss-symposium.org/wp-content/uploads/2023/02/ndss2023_s119_paper.pdf | 幽灵攻击（Ghost attack）和组猜测攻击 | | | Qualcomm 9206 | Imp | BT/BLE? | | 1 | 2022 | CVE-2022-40503 | 8.2 | | | https://www.cvedetails.com/cve/CVE-2022-40503/?q=CVE-2022-40503 | A2DP Profile 中的缓冲区越界读取 | | | Qualcomm APQ8009 | Imp | BT/BLE? | | 1 | 2022 | CVE-2022-40537 | 7.3 | | | https://www.cvedetails.com/cve/CVE-2022-40537/?q=CVE-2022-40537 | 处理 AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP 响应时发生内存损坏 | | | Qualcomm WSA8815 | Imp | BT/BLE? | | 1 | 2022 | CVE-2022-33280 | 7.3 | | | https://www.cvedetails.com/cve/CVE-2022-33280/?q=CVE-2022-33280 | 处理 AVRCP 数据包时发生内存损坏 | | | Qualcomm WSA8835 | Imp | BT/BLE? | | 1 | 2022 | CVE-2022-33255 | 8.2 | | | https://www.cvedetails.com/cve/CVE-2022-33255/?q=CVE-2022-33255 | 蓝牙 HOST 在处理 GetFolderItems、GetItemAttributes 时发生缓冲区越界读取 | | | Qualcomm WSA8835 | Imp | BT/BLE? | | 1 | 2022 | CVE-2022-22088 | 9.8 | | | https://www.cvedetails.com/cve/CVE-2022-22088/?q=CVE-2022-22088 | 蓝牙 Host 在处理远程响应时发生缓冲区溢出 | | | SnapDragon Auto | Imp | BT/BLE? | | 1 | 2021 | CVE-2021-35068 | 9.8 | | | https://www.cvedetails.com/cve/CVE-2021-35068/?q=CVE-2021-35068 | 释放 HFP Profile 时发生空指针解引用 | | | Method Confusion | Prot | BT/BLE? | 2.1-5.2 | 1 | 2020 | CVE-2020-10134 | 6.3 | 大量具备不同功能的设备。 | https://github.com/maxdos64/BThack | https://www.sec.in.tum.de/i20/publications/method-confusion-attack-on-bluetooth-pairing/@@download/file/conference-proceeding.pdf | 两个 BLE 或 BR/EDR 设备之间的中间人攻击。需要特殊硬件，CVE-2020-10134 | | | BlueSnarf revisited | Imp | OBEX | | 1 | 2011 | | | | | https://inria.hal.science/hal-01587858/document | OBEX 路径遍历（FTP） |YAML DSL 参考语法可在此处获取。
徽章：
BlueToolkit 采用 知识共享署名-非商业性使用-相同方式共享 4.0 国际许可协议授权。
如需咨询，请联系 https://linktr.ee/schwytz
| CVE-2018-5383 | MitM | MiTM | 自动 | ✓ | ✓ |
| 方法混淆攻击 | MitM | MiTM | 自动 | ✓ |
| 支持 SSP（<= 4.0 弱加密）或完全支持 SSP | MitM | 信息/MitM | 自动 | ✓ |
| CVE-2020-24490 | 严重 | DoS | 自动 | ✓ |
| CVE-2017-1000250 | 严重 | 信息泄漏 | 自动 | ✓ |
| CVE-2020-12351 | 严重 | RCE/DoS | 自动 | ✓ |
| CVE-2017-1000251 | 严重 | RCE/DoS | 自动 | ✓ |
| V1 功能页执行 | 严重 | RCE/DoS | 自动 | ✓ | ✓ |
| 未知的重复封装负载 | DoS | DoS | 自动 | ✓ | ✓ |
| V2 截断的 SCO 链路请求 | DoS | DoS | 自动 | ✓ | ✓ |
| V4 功能响应泛洪 | DoS | DoS | 自动 | ✓ | ✓ |
| V5 LMP 自动速率溢出 | DoS | DoS | 自动 | ✓ | ✓ |
| V6 LMP 2-DH1 溢出 | DoS | DoS | 自动 | ✓ | ✓ |
| V7 LMP DM1 溢出 | DoS | DoS | 自动 | ✓ | ✓ |
| V8 截断的 LMP 已接受 | DoS | DoS | 自动 | ✓ | ✓ |
| V9 无效的设置完成 | DoS | DoS | 自动 | ✓ | ✓ |
| V10 主机连接泛洪 | DoS | DoS | 自动 | ✓ | ✓ |
| V11 同一主机连接 | DoS | DoS | 自动 | ✓ | ✓ |
| V12 AU 随机泛洪 | DoS | DoS | 自动 | ✓ | ✓ |
| V14 最大时隙长度溢出 | DoS | DoS | 自动 | ✓ | ✓ |
| V15 无效的定时精度 | DoS | DoS | 自动 | ✓ | ✓ |
| V16 寻呼扫描死锁 | DoS | DoS | 自动 | ✓ | ✓ |
| 未知的错误封装负载 | DoS | DoS | 自动 | ✓ | ✓ |
| 未知 sdp 未知元素类型 | DoS | DoS | 自动 | ✓ | ✓ |
| 未知 sdp 超大元素大小 | DoS | DoS | 自动 | ✓ | ✓ |
| 未知功能请求乒乓 | DoS | DoS | 自动 | ✓ | ✓ |
| 未知 lmp 无效传输 | DoS | DoS | 自动 | ✓ | ✓ |
| CVE-2020-12352 | 严重 | 信息泄漏 | 自动 | ✓ |