The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mi_true_wireless_earbuds_basic_2_firmware | Mi | - (including) | - (including) |
References
- http://www.bluetrum.com/product/ab5376t.html
- http://www.bluetrum.com/product/bt8896a.html
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
- https://www.mi.com/global/mi-true-wireless-earbuds-basic-2/
- http://www.bluetrum.com/product/ab5376t.html
- http://www.bluetrum.com/product/bt8896a.html
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
- https://www.mi.com/global/mi-true-wireless-earbuds-basic-2/