CVE-2021-28139: Espressif ESP-IDF RCE Vulnerability

CVE-2021-28139 Overview

CVE-2021-28139 is a critical firmware vulnerability affecting the Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier versions. The vulnerability exists in the handling of LMP (Link Manager Protocol) Feature Response Extended packets, where the Feature Page is not properly restricted upon reception. This flaw allows attackers within Bluetooth radio range to trigger arbitrary code execution on ESP32 devices by sending a crafted Extended Features bitfield payload.

This vulnerability is part of the broader "BrakTooth" family of Bluetooth Classic vulnerabilities, which affect multiple commercial Bluetooth chipsets. The ESP32's widespread deployment in IoT devices, industrial systems, smart home products, and consumer electronics significantly amplifies the potential impact of this security flaw.

Critical Impact
Attackers within Bluetooth radio range can achieve arbitrary code execution on vulnerable ESP32 devices without authentication, potentially compromising IoT ecosystems, smart home systems, and industrial control devices.

Affected Products

Espressif ESP-IDF versions 4.4 and earlier
Espressif ESP32 hardware with Bluetooth Classic enabled
All devices utilizing ESP32 with vulnerable ESP-IDF Bluetooth Classic stack

Discovery Timeline

September 7, 2021 - CVE-2021-28139 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-28139

Vulnerability Analysis

The vulnerability resides in the Bluetooth Classic stack's handling of LMP Feature Response Extended packets. The Link Manager Protocol is responsible for link setup and control between Bluetooth devices, including the exchange of supported features through LMP_FEATURES_REQ and LMP_FEATURES_RES transactions.

When an ESP32 device receives an LMP Feature Response Extended packet, the implementation fails to properly validate the Feature Page parameter. The Feature Page field is intended to indicate which page of extended features is being reported (e.g., Page 1, Page 2), with each page containing a 64-bit features bitmask. The vulnerable implementation does not adequately bounds-check this value before using it as an index or offset in memory operations.

An attacker can craft a malicious Extended Features packet with an out-of-bounds Feature Page value combined with a specially constructed bitfield payload. When processed by the vulnerable Bluetooth stack, this triggers memory corruption that can be leveraged to achieve arbitrary code execution on the ESP32 microcontroller.

Root Cause

The root cause of this vulnerability is insufficient input validation in the Bluetooth Classic stack's LMP packet processing routines. Specifically, the code fails to verify that the Feature Page value falls within the expected range before using it in subsequent operations. This constitutes an improper input validation flaw that leads to memory corruption.

The ESP32's Bluetooth stack processes LMP packets in a privileged context, meaning successful exploitation provides the attacker with significant control over the device's execution environment. The lack of proper boundary checks on protocol fields received over the air represents a critical security oversight in the firmware design.

Attack Vector

The attack vector requires the attacker to be within Bluetooth radio range of the target ESP32 device (typically up to 100 meters with Class 1 Bluetooth). The attack can be executed against any ESP32 device with Bluetooth Classic functionality enabled, without requiring prior authentication or pairing.

The attack flow involves:

The attacker establishes a Bluetooth Classic connection attempt with the target ESP32 device
During the link setup phase, LMP packets are exchanged to negotiate features
The attacker sends a malformed LMP Feature Response Extended packet with a crafted Feature Page and bitfield payload
The vulnerable ESP32 Bluetooth stack processes the packet without proper validation
Memory corruption occurs, allowing the attacker to redirect execution flow
Arbitrary code execution is achieved on the ESP32 processor

Due to the absence of verified code examples, technical details of the specific exploitation mechanism can be found in the BrakTooth research paper.

Detection Methods for CVE-2021-28139

Indicators of Compromise

Unexpected Bluetooth connection attempts or authentication failures on ESP32-based devices
Anomalous behavior in IoT devices utilizing ESP32 chips, such as unexpected reboots or unresponsive states
Bluetooth Classic activity from unknown or suspicious MAC addresses in proximity to affected devices
Device firmware integrity check failures or unexpected modifications

Detection Strategies

Implement Bluetooth traffic monitoring to detect malformed LMP packets with invalid Feature Page values
Deploy network segmentation to isolate IoT devices and limit lateral movement from compromised ESP32 systems
Utilize endpoint detection and response solutions capable of monitoring embedded device behavior
Conduct regular firmware version audits to identify devices running vulnerable ESP-IDF versions

Monitoring Recommendations

Monitor for Bluetooth Classic connection attempts during unusual hours or from unauthorized locations
Implement logging of Bluetooth stack events where device capabilities allow
Establish baseline behavior profiles for ESP32-based IoT devices to detect anomalous activity
Deploy physical security measures to limit Bluetooth radio range access in sensitive environments

How to Mitigate CVE-2021-28139

Immediate Actions Required

Update ESP-IDF to version 4.4.1 or later, which contains patches for this vulnerability
Disable Bluetooth Classic functionality on ESP32 devices where it is not required for operation
Reduce Bluetooth transmission power to minimize the effective attack range where possible
Implement physical access controls to limit proximity-based attacks in critical deployments

Patch Information

Espressif has addressed this vulnerability in updated versions of the ESP-IDF framework and the ESP32 Bluetooth library. Organizations should upgrade to ESP-IDF version 4.4.1 or later and update the esp32-bt-lib component to the latest available version.

Refer to the GitHub ESP-IDF Repository for the latest firmware releases. For Bluetooth-specific updates, consult the GitHub ESP32 BT Library repository. Additional product information is available on the Espressif ESP32 Product Page.

Workarounds

Disable Bluetooth Classic and use Bluetooth Low Energy (BLE) instead, as BLE uses a different stack not affected by this vulnerability
Implement RF shielding or deploy devices in locations with limited physical access to reduce radio-range attack feasibility
Use external Bluetooth modules with patched firmware if ESP32 Bluetooth Classic functionality is required
Consider replacing affected ESP32 devices with newer hardware revisions that ship with patched firmware

bash

# ESP-IDF configuration to disable Bluetooth Classic
# In your project's sdkconfig or using menuconfig:
CONFIG_BT_CLASSIC_ENABLED=n
CONFIG_BT_ENABLED=y
CONFIG_BT_BLUEDROID_ENABLED=y
CONFIG_BT_BLE_ENABLED=y