CVE-2020-26559: 
Linux Ubuntu vulnerability analysis and mitigation

The Bluetooth Mesh Profile AuthValue leak (CVE-2020-26559) is a security vulnerability discovered in Bluetooth Mesh Profile versions 1.0 and 1.0.1. The vulnerability was disclosed on May 24, 2021, affecting the provisioning process in Bluetooth Mesh networks. This flaw allows a nearby device participating in the provisioning protocol to identify the AuthValue used, given the Provisioner's public key, confirmation number, and nonce provided by the provisioning device (NIST NVD, CERT Advisory).

The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Even when using a randomly generated AuthValue with full 128-bits of entropy, an attacker can compute the AuthValue directly by acquiring the Provisioner's public key, provisioning confirmation value, and provisioning random value, and providing its public key for use in the provisioning procedure (NIST NVD).

The vulnerability could allow an attacker to compute the AuthValue and authenticate to both the Provisioner and provisioned devices. This enables unauthorized access to the provisioning process without requiring brute-force of the AuthValue, potentially compromising the security of the entire mesh network (CERT Advisory).

The vulnerability can be exploited by a nearby attacker who can participate in the provisioning protocol. The attack does not require brute-forcing the AuthValue, making it a practical threat for devices within wireless range. The exploit allows an attacker to complete provisioning without knowledge of the AuthValue (Hacker News).

The Bluetooth Special Interest Group (SIG) recommends that potentially vulnerable mesh provisioners use an out-of-band mechanism to exchange the public keys. Users should ensure they have installed the latest recommended updates from device and operating system manufacturers (Bluetooth SIG).

Several major vendors were identified as affected by this vulnerability, including Android Open Source Project (AOSP), Cisco, Cradlepoint, Intel, and Microchip Technology. AOSP and Cisco acknowledged the vulnerability and began working on security updates to address the issue (GBHackers).