{
  "threat_severity" : "Important",
  "public_date" : "2019-08-10T09:00:00Z",
  "bugzilla" : {
    "description" : "hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB)",
    "id" : "1727857",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1727857"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-327",
  "details" : [ "The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka \"KNOB\") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.", "A flaw was discovered in the Bluetooth protocol.  An attacker within physical proximity to the Bluetooth connection could downgrade the encryption protocol to be trivially brute forced." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2019-10-16T00:00:00Z",
    "advisory" : "RHSA-2019:3089",
    "cpe" : "cpe:/a:redhat:rhel_extras_rt:7",
    "package" : "kernel-rt-0:3.10.0-1062.4.1.rt56.1027.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2019-10-16T00:00:00Z",
    "advisory" : "RHSA-2019:3055",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kernel-0:3.10.0-1062.4.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2019-10-16T00:00:00Z",
    "advisory" : "RHSA-2019:3076",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3217",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "kernel-alt-0:4.14.0-115.14.1.el7a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.2 Advanced Update Support",
    "release_date" : "2020-04-14T00:00:00Z",
    "advisory" : "RHSA-2020:1460",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.2",
    "package" : "kernel-0:3.10.0-327.86.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.3 Advanced Update Support",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3218",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.3",
    "package" : "kernel-0:3.10.0-514.70.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.3 Telco Extended Update Support",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3218",
    "cpe" : "cpe:/o:redhat:rhel_tus:7.3",
    "package" : "kernel-0:3.10.0-514.70.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3218",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.3",
    "package" : "kernel-0:3.10.0-514.70.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Advanced Update Support",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3187",
    "cpe" : "cpe:/o:redhat:rhel_aus:7.4",
    "package" : "kernel-0:3.10.0-693.60.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Telco Extended Update Support",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3187",
    "cpe" : "cpe:/o:redhat:rhel_tus:7.4",
    "package" : "kernel-0:3.10.0-693.60.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions",
    "release_date" : "2019-10-24T00:00:00Z",
    "advisory" : "RHSA-2019:3187",
    "cpe" : "cpe:/o:redhat:rhel_e4s:7.4",
    "package" : "kernel-0:3.10.0-693.60.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.5 Extended Update Support",
    "release_date" : "2019-10-08T00:00:00Z",
    "advisory" : "RHSA-2019:2975",
    "cpe" : "cpe:/o:redhat:rhel_eus:7.5",
    "package" : "kernel-0:3.10.0-862.43.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Extended Update Support",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3220",
    "cpe" : "cpe:/o:redhat:rhel_eus:7.6",
    "package" : "kernel-0:3.10.0-957.38.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7.6 Extended Update Support",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3231",
    "cpe" : "cpe:/o:redhat:rhel_eus:7.6",
    "package" : "kpatch-patch"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2019-11-05T00:00:00Z",
    "advisory" : "RHSA-2019:3309",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-147.rt24.93.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2019-11-05T00:00:00Z",
    "advisory" : "RHSA-2019:3517",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-147.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions",
    "release_date" : "2020-01-22T00:00:00Z",
    "advisory" : "RHSA-2020:0204",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.0",
    "package" : "kernel-0:4.18.0-80.15.1.el8_0"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "release_date" : "2019-10-22T00:00:00Z",
    "advisory" : "RHSA-2019:3165",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2:server:el6",
    "package" : "kernel-rt-1:3.10.0-693.60.1.rt56.654.el6rt"
  }, {
    "product_name" : "Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS",
    "release_date" : "2019-10-29T00:00:00Z",
    "advisory" : "RHSA-2019:3220",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7::hypervisor",
    "package" : "kernel-0:3.10.0-957.38.1.el7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-9506\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-9506" ],
  "name" : "CVE-2019-9506",
  "mitigation" : {
    "value" : "At this time there is no known mitigation if bluetooth hardware is to be continue to be used.   Replacing the hardware with its wired version and disabling bluetooth may be a suitable alternative for some environments.",
    "lang" : "en:us"
  },
  "csaw" : false
}