{"id":31914,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu","title":{"rendered":"Vulnerabilities in Broadcom WiFi chip drivers allow remote attacks on the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In the drivers for Broadcom wireless chips seven vulnerabilities have been identified<\/a><\/noindex> four a vulnerability<\/a><\/noindex>. In the simplest case, vulnerabilities can be exploited for remote denial-of-service, but scenarios are not excluded where exploits could allow an unauthenticated attacker to execute their code with Linux kernel privileges through the sending of specially crafted packets.<\/p>\n

The problems were identified during the reverse engineering of Broadcom firmware. The vulnerable chips are widely used in laptops, smartphones, and various consumer devices, from Smart TVs to Internet of Things devices. In particular, Broadcom chips are used in smartphones from manufacturers such as Apple, Samsung, and Huawei. Notably, Broadcom was notified of the vulnerabilities back in September 2018, but it took about 7 months to coordinate the release of patches with hardware manufacturers.<\/p>\n

Two vulnerabilities affect the internal firmware and potentially allow code execution in the operating environment used in Broadcom chips, enabling attacks on environments that do not use Linux (for example, an attack on Apple devices has been confirmed, CVE-2019-8564<\/a><\/noindex>). It is worth noting that some Broadcom Wi-Fi chips serve as specialized processors (ARM Cortex R4 or M3), on which a semblance of their operating system runs with implementations of their wireless stack 802.11 (FullMAC). In such chips, the driver facilitates interaction between the main system and the Wi-Fi chip firmware. To gain full control over the main system after compromising FullMAC, it is recommended to use additional vulnerabilities or, on some chips, to take advantage of full access to the system memory. In chips with SoftMAC, the 802.11 wireless stack is implemented on the driver side and is executed using the system CPU.<\/p>\n

\"Vulnerabilities<\/a><\/noindex><\/center><\/p>\n

Vulnerabilities in the drivers are manifested both in the proprietary wl driver (SoftMAC and FullMAC) and in the open-source brcmfmac (FullMAC). Two buffer overflows have been identified in the wl driver, exploited during the transmission of specially crafted EAPOL messages during the connection negotiation process (an attack can be carried out when connecting to a malicious access point). In the case of the SoftMAC chip, vulnerabilities lead to a compromise of the system kernel, whereas in the case of FullMAC, code can be executed on the firmware side. The brcmfmac driver has a buffer overflow and a frame processing error, which can be exploited by sending control frames. There are issues in the brcmfmac driver in the Linux kernel. existed<\/a><\/noindex> four vulnerabilities have been fixed<\/a><\/noindex> in February.<\/p>\n

Identified vulnerabilities:<\/p>\n