From 3d61ed3c64327cc1bdcb30cbfaaaa62e5dbf3c78 Mon Sep 17 00:00:00 2001 From: Prasad Alatkar Date: Wed, 14 Apr 2021 20:55:41 +0530 Subject: [PATCH] nimble/host: Fix MITM vulnerability during public key exchange in secure connection --- nimble/host/src/ble_sm_sc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/nimble/host/src/ble_sm_sc.c b/nimble/host/src/ble_sm_sc.c index 1293de3a4..abd342d6c 100644 --- a/nimble/host/src/ble_sm_sc.c +++ b/nimble/host/src/ble_sm_sc.c @@ -569,6 +569,13 @@ ble_sm_sc_public_key_rx(uint16_t conn_handle, struct os_mbuf **om, cmd = (struct ble_sm_public_key *)(*om)->om_data; BLE_SM_LOG_CMD(0, "public key", conn_handle, ble_sm_public_key_log, cmd); + /* Check if the peer public key is same as our generated public key. + * Return fail if the public keys match. */ + if (memcmp(cmd, ble_sm_sc_pub_key, 64) == 0) { + res->enc_cb = 1; + res->sm_err = BLE_SM_ERR_AUTHREQ; + return; + } ble_hs_lock(); proc = ble_sm_proc_find(conn_handle, BLE_SM_PROC_STATE_PUBLIC_KEY, -1,