TI LP-CC2652RB BLE Link Layer LL_PAUSE_ENC_REQ DoS Vulnerability Analysis

Critical Vulnerability Information 1. Vulnerability Overview Device: Texas Instruments LP-CC2652RB Bluetooth Low Energy (BLE) SoC Issue: The device incorrectly accepts unencrypted LL_PAUSE_ENC_REQ packets during the connection phase, triggering an encryption pause process and causing protocol state machine confusion and denial-of-service conditions. 2. Affected Components Device: LP-CC2652RB Protocol Layer: Link Layer (LL) Packet: LL_PAUSE_ENC_REQ (Opcode: 0x0A) SDK Version: SimpleLink CC13XX CC26XX SDK 7.41.00.17 3. Vulnerability Details Description: During BLE connection establishment, an attacker can inject an unencrypted LL_PAUSE_ENC_REQ packet before encryption is complete, causing the LP-CC2652RB to enter an encryption pause state, violating the expected link layer state machine. Impact: - Device enters an inconsistent state where encryption cannot be completed. - Future pairing or secure communication fails. - Affected sessions are discarded or indefinitely suspended. - Repeated exploitation may lead to denial-of-service (DoS) or degraded BLE functionality. Root Cause: The device fails to verify that encryption is active before receiving an LL_PAUSE_ENC_REQ packet, violating Bluetooth Core Specification v5.3 Vol 6, Part B, Section 5.1.3. 4. Proof of Concept (PoC) A PoC has been developed to reproduce the issue. The PoC initiates a BLE connection and injects an unencrypted LL_PAUSE_ENC_REQ packet, resulting in session interruption. Detailed information and scripts are available in Accept_Pause_Enc_Req.py. 5. Reproduction Steps 1. Initialize a BLE connection with the LP-CC2652RB. 2. Inject a raw, unencrypted LL_PAUSE_ENC_REQ packet before receiving a Pairing_Request. 3. Observe the device accepting the packet and halting the pairing process. 6. Security Impact Attack Vector: Remote (over-the-air, during pairing) Impact: Connection hijacking prevention failure, authentication failure, DoS 7. Recommended Fixes Verify that encryption is active before receiving any LL_PAUSE_ENC_REQ packet. Implement state checks before transitioning to the encryption pause process. Discard or reject any control packets that violate protocol sequence rules. 8. References Bluetooth Core Specification v5.3: Vol 6, Part B - Link Layer Control Procedures, Section 5.1.3 LL Control Opcode Table: Opcode 0x0A = LL_PAUSE_ENC_REQ

Goal Reached Thanks to every supporter — we hit 100%!

TI LP-CC2652RB BLE Link Layer LL_PAUSE_ENC_REQ DoS Vulnerability Analysis

More from this source