CVE-2023-24023: Mitre: CVE-2023-24023 Bluetooth Vulnerability

CVE-2023-24023 is a spoofing vulnerability in Mitre, rated Important by Microsoft. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.29% probability of exploitation activity in the next 30 days, higher than 70% of all scored vulnerabilities. Microsoft released the fix on 14 November 2023 in the November 2023 Patch Tuesday, delivered through 7 security updates (KB5032196, KB5032198, KB5032304, KB5032192 and more). It affects 20 products in 1 product family (Windows).

Key facts

CVE ID: CVE-2023-24023
Severity: N/A
Microsoft severity: Important
Impact: Spoofing
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
EPSS: 1.29% (percentile 70%)
CISA KEV: Not listed
Released: 14 November 2023
Last updated: 18 January 2024
Patch Tuesday: November 2023 Patch Tuesday
Product families: Windows

Description

Microsoft is aware of the Bluetooth Forward and Future Secrecy Attacks and Defenses (BLUFFS) vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG.

To address the vulnerability, Microsoft has released a software update that enforces the use of BR/EDR Secure Connections defined encryption and authentication algorithms for Bluetooth pairings that have used BR/EDR Secure Connections. If a paired device used BR/EDR Secure Connection at some point, Windows will enforce all subsequent BR/EDR connections to use BR/EDR Secure Connections.

As defined by the BR/EDR Secure Connections protocol, the new BR/EDR Secure Connections algorithms will only be used when the local system and the remote paired device both support BR/EDR Secure Connections. Connections between the local system and the remote paired device will remain vulnerable if either the local system or the remote paired device never declare support for BR/EDR Secure Connections during encryption or authentication..

Additionally, it is advised to increase the minimum encryption key size as described in Windows guidance for Bluetooth key length enforcement. Increasing the minimum encryption key size does not require support for BR/EDR Secure Connections.

Frequently asked questions (Microsoft)

Why is the MITRE Corporation the assigning CNA (CVE Numbering Authority)?

CVE-2023-24023 is regarding a vulnerability reported to the Bluetooth Special Interest Group (Bluetooth SIG). MITRE assigned this CVE number on behalf of the Bluetooth organization https://www.bluetooth.com/about-us/vision/.

For more information, please see this statement from the Bluetooth SIG.

Affected products (20)

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1809 for 32-bit Systems	KB5032196	Security Update	10.0.17763.5122	Yes
Windows 10 Version 1809 for x64-based Systems	KB5032196	Security Update	10.0.17763.5122	Yes
Windows 10 Version 1809 for ARM64-based Systems	KB5032196	Security Update	10.0.17763.5122	Yes
Windows Server 2019	KB5032196	Security Update	10.0.17763.5122	Yes
Windows Server 2019 (Server Core installation)	KB5032196	Security Update	10.0.17763.5122	Yes
Windows Server 2022	KB5032198 KB5032304	Security Update SecurityHotpatchUpdate	10.0.20348.2113 10.0.20348.2091	Yes No
Windows Server 2022 (Server Core installation)	KB5032198 KB5032304	Security Update SecurityHotpatchUpdate	10.0.20348.2113 10.0.20348.2091	Yes No
Windows 11 version 21H2 for x64-based Systems	KB5032192	Security Update	10.0.22000.2600	Yes
Windows 11 version 21H2 for ARM64-based Systems	KB5032192	Security Update	10.0.22000.2600	Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5032189	Security Update	10.0.19043.3693	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5032189	Security Update	10.0.19043.3693	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5032189	Security Update	10.0.19043.3693	Yes
Windows 11 Version 22H2 for ARM64-based Systems	KB5032190	Security Update	10.0.22621.2715	Yes
Windows 11 Version 22H2 for x64-based Systems	KB5032190	Security Update	10.0.22621.2715	Yes
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2022, 23H2 Edition (Server Core installation)	KB5032202	Security Update	10.0.25398.531	Yes

Security updates (7)

KB5032196 (Security Update)
KB5032198 (Security Update)
KB5032304 (SecurityHotpatchUpdate)
KB5032192 (Security Update)
KB5032189 (Security Update)
KB5032190 (Security Update)
KB5032202 (Security Update)

NIST NVD data

NVD status: Modified
NVD CVSS: 6.8 (MEDIUM)
Published to NVD: 28 November 2023
NVD last modified: 17 June 2026

Affected configurations (CPE)

Product	Vulnerable versions
bluetooth core specification	from 4.2, up to and including 5.4
windows 10 1809	before 10.0.17763.5122
windows 10 21h2	before 10.0.19043.3693
windows 10 22h2	before 10.0.19045.3693
windows 11 21h2	before 10.0.22000.2600
windows 11 22h2	before 10.0.22621.2715
windows 11 23h2	before 10.0.22631.2715
windows server 2019	before 10.0.17763.5122
windows server 2022	before 10.0.20348.2113
windows server 2022 23h2	before 10.0.25398.531

References

https://dl.acm.org/doi/10.1145/3576915.3623066 (Technical Description, Third Party Advisory)
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/ (Vendor Advisory)
https://dl.acm.org/doi/10.1145/3576915.3623066 (Technical Description, Third Party Advisory)
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/ (Vendor Advisory)

Acknowledgments

Daniele Antonioli an assistant professor at EURECOM

Revision history

Version	Date	Description
1.0	14 November 2023	Information published.
1.1	18 January 2024	The software update Microsoft released to address this vulnerability enforces the use of BR/EDR Secure Connections defined encryption and authentication algorithms for Bluetooth pairings that have used BR/EDR Secure Connections. For more information see the Executive Summary section. This is an informational change only.