CVE-2019-9500

Description

The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

CVSS Metrics

• v3.1•HIGH•Score: 7.9CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
• v3.1•HIGH•Score: 8.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
• v2.0•HIGH•Score: 7.9AV:A/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 2.93%• Percentile: 87%

Techniques & Countermeasures

• CWE-787•Out-of-bounds Write

  The product writes data past the end, or before the beginning, of the intended buffer.

• CWE-122•Heap-based Buffer Overflow

  A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected Systems

• broadcom•brcmfmac_driver

  na

• broadcom•brcmfmac wifi driver

  commit prior to 1b5e2423164b3670e8bc9174e4762d297990deff

• linux•linux_kernel

  ≥ 4.5, < 4.9.181 | ≥ 4.10, < 4.14.123 | ≥ 4.15, < 4.19.47 | ≥ 4.20, < 5.0.20

References (3)

• https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html
• https://kb.cert.org/vuls/id/166939/
• https://git.kernel.org/linus/1b5e2423164b3670e8bc9174e4762d297990deff