Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code

Re:Broadcom BCM43xx Wi-Fi chips allow remote attackers to ex... by qb45 on Saturday July 15, 2017 @11:27AM (#14777117)

Probably not all BCM43xx devices are affected, though. This product line spans over 10 years and all 802.11 revisions since a/b with various firmwares and internal CPUs, from custom cores to ARM.

The issue likely exists in a limited number of chips, possibly only FullMAC ones, like similar bug found earlier by Google:

https://googleprojectzero.blogspot.com/2017/04/over-air-expl...

edit:

Actually NIST lists the vulnerable NICs: BCM4354, BCM4358, BCM4359.

[ Parent | on HN ]

Re:Broadcom BCM43xx Wi-Fi chips allow remote attackers to ex... by osivertsson on Saturday July 15, 2017 @02:21PM (#14778104)

NIST's list is incomplete, at least BCM43570 is vulnerable as well [1]. I would expect many more Broadcom chips to be vulnerable even if exploits may need to be tweaked.

[1] I'm part of a team that develops a product with this chip, and I've used the hostapd configuration I linked elsewhere in this topic to show it is vulnerable.

[ Parent | on HN ]