CVE-2019-9502: broadcom bcm4339_firmware Heap-based Buffer Overflow

Vulnerability summary

CVE-2019-9502 is a high (CVSS 8.8) Heap-based Buffer Overflow vulnerability in broadcom bcm4339_firmware. EPSS estimates a 2.60% chance of exploitation in the next 30 days, higher than 85.1% of scored vulnerabilities.

Timeline

1. 03-02-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.