{"id":31914,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een driverele pentru cipurile WiFi Broadcom, care permit atacuri remote asupra sistemului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen driverele pentru cipurile wireless Broadcom <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.quarkslab.com\/reverse-engineering-broadcom-wireless-chipsets.html\">identificate<\/a><\/noindex> patru <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kb.cert.org\/vuls\/id\/166939\/\">vulnerabilit\u0103\u021bi<\/a><\/noindex>. \u00cen cele mai simple cazuri, vulnerabilit\u0103\u021bile pot fi folosite pentru a provoca atacuri de tip denial of service la distan\u021b\u0103, dar nu sunt excluse scenariile \u00een care pot fi dezvoltate exploat\u0103ri care permit unui atacator neautentificat s\u0103 execute cod cu privilegii de kernel Linux prin trimiterea unor pachete formate special.<\/p>\n<p>Problemele au fost identificate \u00een timpul ingineriei inversate a firmware-urilor Broadcom. Cipurile vulnerabile sunt utilizate pe scar\u0103 larg\u0103 \u00een laptopuri, smartphone-uri \u0219i diverse dispozitive de consum, de la SmartTV-uri la dispozitive IoT. \u00cen special, cipurile Broadcom sunt utilizate \u00een smartphone-uri de la produc\u0103tori precum Apple, Samsung \u0219i Huawei. Este demn de men\u021bionat c\u0103 compania Broadcom a fost notificat\u0103 despre vulnerabilit\u0103\u021bi \u00eenc\u0103 din septembrie 2018, dar lansarea corec\u021biilor coordonate cu produc\u0103torii de hardware a durat aproape 7 luni.<\/p>\n<p>Dou\u0103 vulnerabilit\u0103\u021bi afecteaz\u0103 firmware-ul intern \u0219i permit poten\u021bial executarea codului \u00een mediul sistemului de operare utilizat \u00een cipurile Broadcom, ceea ce permite atacarea mediilor care nu folosesc Linux (de exemplu, a fost confirmat\u0103 posibilitatea de atac asupra dispozitivelor Apple, <noindex><a rel=\"nofollow\" href=\"https:\/\/support.apple.com\/en-us\/HT209600\">CVE-2019-8564<\/a><\/noindex>). Reamintim c\u0103 unele cipuri Wi-Fi Broadcom constau \u00eentr-un procesor specializat (ARM Cortex R4 sau M3), pe care ruleaz\u0103 un sistem de operare similar cu o implementare a stivei wireless 802.11 (FullMAC). \u00cen aceste cipuri, driverul asigur\u0103 interac\u021biunea sistemului principal cu firmware-ul cipului Wi-Fi. Pentru a ob\u021bine control asupra sistemului principal dup\u0103 compromiterea FullMAC, se recomand\u0103 utilizarea de vulnerabilit\u0103\u021bi suplimentare sau, pe unele cipuri, exploatarea accesului complet la memoria sistemului. \u00cen cipurile cu SoftMAC, stiva wireless 802.11 este implementat\u0103 pe partea driverului \u0219i ruleaz\u0103 folosind CPU-ul sistemului.<\/p>\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/blog.quarkslab.com\/resources\/2019-04-16_reversing-broadcom-wifi-chipsets\/bcm_global_stack.png\"><img decoding=\"async\" alt=\"Vulnerabilit\u0103\u021bi \u00een driverele pentru cipurile WiFi Broadcom, care permit atacuri remote asupra sistemului\" src=\"\/wp-content\/uploads\/2019\/04\/c84d863cd67388f31b82b6f71f3f273c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>Vulnerabilit\u0103\u021bile din drivere apar at\u00e2t \u00een driverul proprietar wl (SoftMAC \u0219i FullMAC), c\u00e2t \u0219i \u00een driverul deschis brcmfmac (FullMAC). \u00cen driverul wl au fost identificate dou\u0103 dep\u0103\u0219iri ale buffer-ului, care sunt exploatate prin transmiterea unor mesaje EAPOL special concepute \u00een procesul de negociere a conexiunii (atacul poate fi realizat prin conectarea la un punct de acces mali\u021bios). \u00cen cazul cipului cu SoftMAC, vulnerabilit\u0103\u021bile duc la compromiterea nucleului sistemului, iar \u00een cazul FullMAC, codul poate fi executat pe partea firmware-ului. \u00cen brcmfmac exist\u0103 dep\u0103\u0219iri ale buffer-ului \u0219i o eroare de verificare a cadrelor procesate, exploatate prin trimiterea cadrelor de control. Problemele sunt \u00een nucleul Linux \u00een driverul brcmfmac. <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/torvalds\/linux.git\/commit\/?id=1b5e2423164b3670e8bc9174e4762d297990deff\">erau<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/git.kernel.org\/pub\/scm\/linux\/kernel\/git\/torvalds\/linux.git\/commit\/?id=a4176ec356c73a46c07c181c6d04039fafa34a9f\">remediate<\/a><\/noindex> \u00een februarie.<\/p>\n<p>Vulnerabilit\u0103\u021bile identificate:<\/p>\n<ul>\n<li class=\"l\"> CVE-2019-9503 \u2014 comportamentul incorect al driverului brcmfmac la procesarea cadrelor de control utilizate pentru interac\u021biunea cu firmware-ul. Dac\u0103 un cadru cu un eveniment de firmware provine dintr-o surs\u0103 extern\u0103, driverul \u00eel ignor\u0103, dar \u00een cazul \u00een care evenimentul este primit prin magistrala intern\u0103, cadrul este trecut cu vederea. Problema este c\u0103 prin magistrala intern\u0103 sunt transmise evenimente de la dispozitive care folosesc USB, ceea ce permite atacatorilor s\u0103 transmit\u0103 cu succes cadre de control al firmware-ului \u00een cazul utiliz\u0103rii adaptoarelor wireless cu interfa\u021b\u0103 USB;\n<li class=\"l\"> CVE-2019-9500 \u2014 activ\u00e2nd func\u021bia \u201eWake-up on Wireless LAN\u201d, poate provoca o dep\u0103\u0219ire a heap-ului \u00een driverul brcmfmac (func\u021bia brcmf_wowl_nd_results) prin trimiterea unui cadru de control special modificat. Aceast\u0103 vulnerabilitate poate fi utilizat\u0103 pentru a executa cod \u00een sistemul principal dup\u0103 compromiterea cipului sau \u00een combina\u021bie cu vulnerabilitatea CVE-2019-9503 pentru a ocoli verific\u0103rile \u00een cazul trimiterii de la distan\u021b\u0103 a cadrului de control;\n<li class=\"l\"> CVE-2019-9501 \u2014 dep\u0103\u0219irea buffer-ului \u00een driverul wl (func\u021bia wlc_wpa_sup_eapol), care apare la procesarea mesajelor, con\u021binutul c\u00e2mpului cu informa\u021bii despre produc\u0103tor dep\u0103\u0219ind 32 de bi\u021bi;\n<li class=\"l\"> CVE-2019-9502 \u2014 dep\u0103\u0219irea buffer-ului \u00een driverul wl (func\u021bia wlc_wpa_plumb_gtk), care apare la procesarea mesajelor, con\u021binutul c\u00e2mpului cu informa\u021bii despre produc\u0103tor dep\u0103\u0219ind 164 de bi\u021bi.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50539\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 \u0434\u043b\u044f \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0447\u0438\u043f\u043e\u0432 Broadcom \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u043f\u0440\u043e\u0441\u0442\u0435\u0439\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, \u043d\u043e \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0430\u044e\u0442\u0441\u044f \u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430 Linux \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432 \u0445\u043e\u0434\u0435 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23774,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31914","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 \u0434\u043b\u044f \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0447\u0438\u043f\u043e\u0432 Broadcom \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 \u043a WiFi-\u0447\u0438\u043f\u0430\u043c Broadcom, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 \u0434\u043b\u044f \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0447\u0438\u043f\u043e\u0432 Broadcom \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:43:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:43:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een driverele pentru cipurile WiFi Broadcom, care permit atacuri la distan\u021b\u0103 asupra sistemului | ProHoster","description":"\u00cen driverele pentru cipurile wireless Broadcom au fost identificate patru","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 \u043a WiFi-\u0447\u0438\u043f\u0430\u043c Broadcom, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 | ProHoster","og:description":"\u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 \u0434\u043b\u044f \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0447\u0438\u043f\u043e\u0432 Broadcom \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0447\u0435\u0442\u044b\u0440\u0435","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-drajverah-k-wifi-chipam-broadcom-pozvolyayushhie-udalyonno-atakovat-sistemu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31914","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31914","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31914"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31914\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/23774"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31914"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31914"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}