BLUESDK - VULNERABILITIES LEADING TO 1-CLICK RCE

---

Product: OpenSynergy BlueSDK

Affected versions: N/A

Fixed versions: N/A

Severity: Critical

CVE numbers: CVE-2024-45431, CVE-2024-45432, CVE-2024-45433, CVE-2024-45434

Authors: Mikhail Evdokimov (PCA)

Slides with technical details: Download

---

PRODUCT DESCRIPTION

OpenSynergy Bluetooth Protocol Stack (BlueSDK) currently provides A2DP, AVRCP, VDP, BIP, BPP, CTN, FTP, GPP, HFP, HSP, HCRP, HDP, HID, MAP, OPP, PAN, PBAP, SAP, DUN, FAX, DID, GATT profiles. It is licensed by the Bluetooth Special Interest Group (SIG). Bluetooth Software Development Kit (Blue SDK) can easily be integrated into any operating system. It supports both BR/EDR (Classic) and Low Energy operations, classic profiles and low energy profiles use the same underlying protocol stack software.

BlueSDK is a popular embedded Bluetooth stack used in the automotive industry, therefore many automotive products on the market may be affected by the identified vulnerabilities.

PCA Team didn’t have access to the source code of BlueSDK product and performed analysis of a compiled BlueSDK-based bluetooth executable located on the testing device.

SUMMARY

PCA Security Assessment Team identified multiple vulnerabilities with low-to-critical severity, allowing an attacker to obtain 1-click Remote Code Execution (RCE) in the operating system of a device which utilizes BlueSDK Bluetooth stack. In this level of access, an attacker could manipulate the system, escalate privileges and perform lateral movement to other components of the target product.

BlueSDK implementation supports various security levels on incoming connections from remote devices. It’s the responsibility of an end developer to select an appropriate authorization security level for a target Bluetooth profile.

The vulnerabilities on testing devices PCA Team used for vulnerability research and verification, were accessible after pairing. However, those vulnerabilities may potentially be available before pairing process on some devices utilizing BlueSDK, as this highly depends on the implementation chosen by the end developer (either by profile security level or “Just Works” SSP mode).

DISCLOSURE TIMELINE

Disclosure timeline with OpenSynergy

PCA would like to note that OpenSynergy freely communicated with us and handled our disclosure promptly.

According to OpenSynergy, patches were rolled out in September 2024. However, not all OEMs received the patch till June 2025. This could have probably been caused by long and complex vehicle supply chains.

TECHNICAL DETAILS

CVE-2024-45434: Use-After-Free In AVRCP

The specific flaw exists within BlueSDK Bluetooth stack. The issue results from the lack of validating the existence of an object prior to performing operations on the object (UAF). An attacker can leverage this vulnerability to obtain remote code execution in the context of a user from whom the Bluetooth process is running.

CVE-2024-45431: Improper validation of a L2CAP channel's remote CID

The specific flaw exists within BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID (CID). An attacker can leverage this vulnerability to create a L2CAP channel with the null identifier assigned as a remote CID.

CVE-2024-45433: Incorrect function termination in RFCOMM

The specific flaw exists within BlueSDK Bluetooth stack. The issue results from the lack of proper return control flow after detected an unusual condition. An attacker can leverage this vulnerability to bypass a security validation and make the incoming data to be processed.

CVE-2024-45432: Function call with incorrect parameter in RFCOMM

The specific flaw exists within BlueSDK Bluetooth stack. The issue results from the incorrect variable used as a function argument. An attacker can leverage this vulnerability to cause unexpected behavior or obtain information leak.

AFFECTED VENDORS

Public resources containing Bluetooth certification information were used to identify vendors and products using BlueSDK framework. Therefore, identified vendors/products are potentially affected. Moreover, vulnerabilities were confirmed on 4 in-vehicle infotainment units of different manufacturers.

The following table is a non-extensive list of affected vendors:

In addition to the already mentioned vendors, a lot of others, including vendors outside automotive industry, are also likely vulnerable to this attack.

Mercedes-Benz: Proof of Exploitation

PCA Team performed proof-of-concept exploitation on Mercedes-Benz NTG6 head unit. It's important to note this is one of many vulnerable Mercedes-Benz head units. Lower and upper (up-to-date) firmware versions are likely to be exploitable as well. The latest-generation head unit model, NTG7, (with up-to-date firmware) may also be affected - it uses BlueSDK as Bluetooth stack.

Information about the testing device is the following:

Below is the demonstration of the reverse shell obtained on top of TCP/IP after successfull Bluetooth exploitation. As you can see, the Bluetooth process is launched with phone user permissions.

Volkswagen: Proof of Exploitation

PCA Team used Volkswagen MEB ICAS3 head unit for exploitation verification. The mentioned head unit is installed on Volkswagen ID model line. It's important to note this is one of many vulnerable Volkswagen head units. Lower and upper (up-to-date) firmware versions are likely to be exploitable as well.

Information about the testing device is the following:

The exploit verification was conducted for 0561 and 0792 firmware versions. Below is the demonstration of the reverse shell obtained on top of TCP/IP after successfull Bluetooth exploitation (on 0561 firmware version). As you can see, the Bluetooth process is launched with sint_sec_btapp user permissions.

Škoda: Proof of Exploitation

PCA Team used Škoda MIB3 head unit for exploitation verification. The mentioned head unit is installed on Škoda Superb model line and some Volkswagen model lines. It's important to note this is one of many vulnerable Škoda head units. Lower and upper (up-to-date) firmware versions are likely to be exploitable as well.

Information about the testing device is the following:

Below is the demonstration of the reverse shell obtained on top of TCP/IP after successfull Bluetooth exploitation. As you can see, the Bluetooth process is launched with phone user permissions.

BMW: Proof of Information Leak

PCA Team used several BMW cars of different model lines to confirm a subset of the identified vulnerabilities leading to information leak of a process' virtual addresses. RCE exploitation wasn't completed at the time of this security research due to absence of BMW firmware for testing vehicles. This section could be updated in the future.

Information about the testing vehicles is the following:

Photo of the last available software update for BMW 218i:

Photo of the last available software update for BMW 220d:

To validate the exploitability of BMW vehicles, PCA Team decided to perform a part of the whole exploitation chain, consisting only of an information leak - the first step of the attack. Below is an example screenshot of a successful information leak performed on both vehicles:

PCA Team has a strong belief that other vulnerabilities are also present within BMW Bluetooth firmware, and it's possible to develop an RCE exploit. However, we must highlight that it wasn't verified due to the already described issues.

CREDITS

PCA Security Assessment team:

• Abdellah Benotsmane
• Aleksei Stennikov
• Artem Ivachev
• Danila Parnishchev
• Mikhail Evdokimov
• Polina Smirnova
• Radu Motspan