MESSAGE HASH (SHA-256): b21f37cdafa7f266a90f694b395bde77aba0a42834cf153f220ceb626ea6564a =========== MESSAGE START =========== Sticky Door Zero-Click HFP/A2DP Takeover via L2CAP Session Preemption Exploiting Seamless Earbud Connection Arbitration to Bypass Pairing Trust Boundaries CVSS (Estimate) v3.1: 7.4 (High) CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L This advisory describes a Bluetooth session-arbitration flaw affecting Samsung Galaxy Buds devices. The issue was reported to Samsung Mobile Security and ultimately classified as "Working as Intended" due to the interaction with the Auto Switching and Seamless Earbud Connection features. Executive Summary A Bluetooth Classic session-management flaw allows a nearby, previously unpaired device to influence connection arbitration and obtain control of active audio profiles without user interaction. During an active audio session, an attacker can trigger repeated L2CAP interactions that cause the earbuds to relinquish ownership of HFP and/or A2DP sessions and transfer control to the attacker's device. This occurs without pairing mode, hardware pairing interaction, user confirmation, or an existing trust relationship. Vulnerability Classification Type: Authentication Bypass / Session Ownership Violation Component: Bluetooth RTOS Stack L2CAP Session Handling Profile Arbitration Logic Seamless Earbud Connection Auto Switching Infrastructure Attack Vector: Bluetooth Classic (Adjacent Network) Affected Devices Confirmed Galaxy Buds FE Galaxy Buds3 Pro Potentially Affected Additional Galaxy Buds models utilizing the same Bluetooth stack and connection arbitration architecture may also be vulnerable. Tested Firmware Galaxy Buds FE (SM-R400N) R400NXXU0AYF1 (June 2025 Rev.1) Galaxy Buds3 Pro (SM-R630) R630XXU0AYJ1 (October 2025 Rev.1) What Is Being Exploited? The attack does not target Bluetooth pairing itself. Instead, it targets the logic responsible for determining which device currently owns the active audio session. Samsung's Auto Switching and Seamless Earbud Connection features appear to allow active ownership of HFP and A2DP profiles to be influenced through unauthenticated L2CAP activity before sufficient validation of session ownership occurs. As a result, the hardware pairing button protects the normal pairing workflow but does not appear to protect the underlying profile arbitration mechanism. Technical Description Phase 1: L2CAP Session Influence Repeated L2CAP Echo Requests are transmitted toward the target while the victim is actively using the earbuds. Observed effects: Audio stuttering Playback interruption HFP instability Connection state fluctuations Phase 2: Session Preemption The earbuds may: Drop the active host session Reassign profile ownership Establish an active relationship with the attacker's device Phase 3: Unauthorized Profile Access HFP The attacker may receive microphone audio from the earbuds. A2DP The attacker may inject arbitrary audio into the victim's earbuds. Impact Privacy Impact An attacker within Bluetooth range may obtain access to live microphone audio transmitted through HFP. Integrity Impact An attacker may inject arbitrary audio through A2DP. Security Model Impact The issue undermines the protection provided by Samsung's hardware pairing key by allowing profile ownership changes through the connection arbitration layer. Vendor Response Samsung classified the issue as "Working as Intended" and stated that disabling Seamless Earbud Connection prevents the attack scenario. The author disagrees with this assessment because the observed behavior allows a previously untrusted device to obtain access to active audio profiles without user authorization under default settings. Code: dbus.c: #include "dbus.h" #include <stdio.h> #include <string.h> #include <systemd/sd-bus.h> void Bluetooth_AddressToPath ( const char * addr, char * out, const size_t len) { // Here we assume hci0 for now snprintf (out, len, "/org/bluez/hci0/dev_" ); const size_t base = strlen (out); for ( size_t i = 0 ; addr[i] && base + i < len - 1 ; i ++ ) { out[base + i] = (addr[i] == ':' ) ? '_' : addr[i]; } out[base + strlen (addr)] = ' \0 ' ; } int Bluetooth_SetTrusted ( const char * addr, const int trusted) { sd_bus * bus = NULL ; sd_bus_error err = SD_BUS_ERROR_NULL; int r = sd_bus_open_system( & bus); if (r < 0 ) return r; char path[ 128 ]; Bluetooth_AddressToPath(addr, path, sizeof (path)); r = sd_bus_set_property( bus, "org.bluez" , path, "org.bluez.Device1" , "Trusted" , & err, "b" , trusted ); sd_bus_error_free( & err); sd_bus_unref(bus); return r; } int Bluetooth_DeviceMethod ( const char * addr, const char * method) { sd_bus * bus = NULL ; sd_bus_error err = SD_BUS_ERROR_NULL; sd_bus_message * msg = NULL ; int r = sd_bus_open_system( & bus); if (r < 0 ) return r; char path[ 128 ]; Bluetooth_AddressToPath(addr, path, sizeof (path)); r = sd_bus_call_method( bus, "org.bluez" , path, "org.bluez.Device1" , method, & err, & msg, NULL ); sd_bus_error_free( & ...