Bluetooth BR/EDR encryption key negotiation vulnerability

[dleach02]

Describe the bug

A security vulnerability in the Bluetooth BR/EDR Bluetooth Core specification versions 1.0 through 5.1 has been identified as CVE-2019-9506. The Bluetooth BR/EDR encryption key negotiation protocol is vulnerable to packet injection that could allow an unauthenticated user to decrease the size of the entropy of the encryption key, potentially causing information disclosure and/or escalation of privileges via adjacent access. There is not currently any knowledge of this being exploited.

The Bluetooth Special Interest Group (SIG) has released specification updates for specification versions 4.2, 5.0, and 5.1 to mitigate this issue. BR/EDR is an experimental feature in Zephyr and should incorporate these changes.

For further information:

https://www.bluetooth.com/security/statement-key-negotiation-of-bluetooth/
https://www.kb.cert.org/vuls/id/918987/

Bluetooth SIG Errata:
http://go.bluetooth.com/R00t2Y8REQ003040B9FFb40