Clearing Air · Develate Portal

Overview#

Espressif has already given a formal response To the newly published claims about the ESP32 Bluetooth controller serving as a potential “backdoor” or have “unexpected features” which can cause security concerns.

This post highlights technical details about related orders (HCI orders) unexplained and set up that mentioned HCI orders do not show a “backdoor” threat “.

What are HCI orders?#

The Bluetooth Protocol stack contains two main layers:

• Bluetooth Controller (Lower Layer) – In charge of radio operations, handling link, and low bluetooth communication levels. Each ESS32 Series Chip has carried out a controller by a combination of hardware and software.
• Bluetooth Host Stack (Upper Layer) – Managed at high bluetooth functions, such as pairing, encrypting, and application-layer interactions. This is fully implemented by software. The ESP32 series of chips supports open source nimble and BlueDroid as Blue Host Stacks.

These layers are talking through a standard call interface with the host controller interface (HCI). HCI describes a set of standard orders for Bluetooth Host Stack of Use. Using Bluetooth Controller enforces standard HCI orders along with a set of vendor orders mainly used for custom hardware initial of custom controls as well as debugging purposes.

What is the reported security issue?#

The reported security issue emphasizes that ESP32 contains a set of HCI orders documents. The issue says it can be used to obtain harmful access to bluetooth operations in ESP32.

What are these messenged commandments?#

The “undocusented” HCI orders mentioned in the report are debug orders to be on the Bluetooth Controller IP in ESS32. Most of these commands are for help with debug (eg, read / write ram, send an active paper to Hcieto.

Such debugging orders, a common paradigm for Bluetooth controller implementations, help developers debugging a controller behavior. This is especially helpful in dual-chip solutions.

ESP32 “Bluetooth#

In the ESP32, the controller and the host both run the same MCU. The host continues to talk to HCI controller. But because both runs on the same MCU, HCI can be treated as a virthutal HCI Layer, an internal intermittee of communication.

Any code access to this virtual HCI layer must be the first execution of ESP32, with privileges of complete murder.

effect#

• For most ESS32 applications, Bluetooth host and controller about the same binary application running in ESP32. There is no risk of security because the application has full privileged access to memory and registrations as the ability to send / receive Bluetooth packpects to these HCI orders.
• These HCI written orders cannot be triggered by Bluetooth, radio signals, or on the Internet, unless there is impairment of the application itself or radio protocols. The presence of such weaknesses can be a larger problem and the presence of written orders will not offer additional facial attacks.
• The original ESP32 chip has these orders. ESP32-C, ESP32-S and ESS32-H chips are not affected because they do not have these commandments supported by their Blue.

ESP32 Hosest mode operate (less used)#

To an unusual-used configuration option, ESP32 can tunnel HCI in a serial (eg, UART HCI) Interface to an external host system. It is usually used in situations where ESP32 works like a communication coprocessor. This type of use of ESP32 is not as common mode of operation operation.

In such a system, the ESP32 fully relied on the host. If an attacker is malicious to get control of the host system, they can run out of debug orders to influence the ess32 behavior. However, an attacker must first compromise the host device, which has made it a second stage of vector attacks instead of a standalone cleanliness. Or, acquire a physical access to the device to send HCI orders to the serial interface.

For uart-hci-based implements, attacks cannot be enjoyed oneself. However a software fix may not disable debug commands by an OTA update for additional security. We have more updates on our software stack about it soon.

Lihiinada#

As directed on the above, no real, known security threat that these written orders are imposing. Anything else, the espressif decided to take the following steps:

• Espresif will provide a repair that removes access to HCI debug orders through a software patch for currently supported ESP-IDF versions
• Esresyof Modok to all vendors specified HCI orders to ensure transpancy what is the use of HCI layer

summary#

To meet, for most ESS32 applications, we do not know any impact from the reported issue given to the recommended features of the platform of platform activated. For a small number of cases of using Bluetooth HCI, we can ease the issue by holding debugging orders and let us give an update ahead.

We follow a standardized Product security response process And we believe in responsible disclosure.

We believe that security of devices based on espresyif chips is important and committed to transparency and best behavior. We will continue to work with the community to ensure that our devices are safe and that all security related information is responsible.