The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wireless_internet_connectivity_for_embedded_devices | Cypress | * | 2.9.0 (including) |
| Bluez-firmware | Ubuntu | esm-apps/jammy | * |
| Bluez-firmware | Ubuntu | jammy | * |
| Bluez-firmware | Ubuntu | kinetic | * |
| Bluez-firmware | Ubuntu | lunar | * |
| Bluez-firmware | Ubuntu | mantic | * |
| Bluez-firmware | Ubuntu | trusty | * |
| Bluez-firmware | Ubuntu | upstream | * |
| Bluez-firmware | Ubuntu | xenial | * |