Bluetooth characteristic LESC security requirement not enforced without additional flags

The core of the vulnerability lies in the misinterpretation of BLE characteristic permissions. The Zephyr BLE stack incorrectly handles the BTGATTPERMREADLESC and BTGATTPERMWRITELESC flags. While these flags are intended to enforce LE Secure Connections for read and write operations, the stack fails to do so when combined with other permissions like BTGATTPERMREADENCRYPT/BTGATTPERMREADAUTHEN or BTGATTPERMWRITEENCRYPT/BTGATTPERMWRITEAUTHEN. An attacker can exploit this by crafting malicious BLE connections that bypass the intended security measures. This could allow them to read or write sensitive data transmitted over the BLE link without proper encryption or authentication, potentially leading to device compromise and data theft. The blast radius extends to any device utilizing Zephyr's BLE stack in vulnerable configurations.

Devices utilizing Zephyr RTOS in Bluetooth Low Energy (BLE) applications are at risk. This includes IoT devices, wearables, and industrial control systems that rely on BLE for communication. Legacy Zephyr deployments and those with custom BLE implementations are particularly vulnerable, as they may not have been updated to address this issue.

• linux / server: Examine Zephyr BLE stack logs for unusual connection attempts or permission errors. Use journalctl -u zephyr to filter for BLE-related messages.

journalctl -u zephyr | grep -i "permission denied"

• c: Review Zephyr source code for instances of BTGATTPERMREADLESC and BTGATTPERMWRITELESC to identify potential vulnerable configurations. Use static analysis tools to detect code patterns that violate the intended permission logic. • generic web: Monitor BLE traffic using tools like Wireshark to identify connections that bypass LE Secure Connections. Look for connections where encryption/authentication is not enforced despite the presence of BTGATTPERMREADLESC or BTGATTPERMWRITELESC.

1. 2024-02-19Disclosure

   disclosure

2. 2024-02-19Patch

   patch

1. Réservé2024-02-19
2. Publiée2024-02-19
3. Modifiée2025-04-24
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-1638 is to upgrade to Zephyr RTOS version 3.5.1 or later, which includes the corrected BLE permission handling. If upgrading is not immediately feasible, consider implementing compensating controls. Carefully review BLE characteristic permissions in your application, ensuring that BTGATTPERMREADENCRYPT/BTGATTPERMREADAUTHEN and BTGATTPERMWRITEENCRYPT/BTGATTPERMWRITEAUTHEN are always set alongside BTGATTPERMREADLESC and BTGATTPERMWRITELESC. Consider implementing a Web Application Firewall (WAF) or proxy to filter BLE traffic and block connections that attempt to bypass security checks. After upgrading, confirm the fix by attempting a BLE connection without the required encryption/authentication permissions and verifying that access is denied.