CVE-2019-9500
published 2020-01-16CVE-2019-9500: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless…
PriorityP350high8.3CVSS 3.1
AVAACHPRNUINSCCHIHAH
EPSS
3.84%
89.0th percentile
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ipados | < 13.2 | 13.2 |
| apple | iphone_os | < 13.2 | 13.2 |
| apple | mac_os_x | < 10.15.1 | 10.15.1 |
| broadcom | brcmfmac_wifi_driver | — | — |
| debian | linux | < linux 4.19.37-4 (bookworm) | linux 4.19.37-4 (bookworm) |
| linux | linux_kernel | >= 0 < 4.19.37-4 | 4.19.37-4 |
| linux | linux_kernel | >= 0 < 4.19.37-4 | 4.19.37-4 |
| linux | linux_kernel | >= 0 < 4.19.37-4 | 4.19.37-4 |
| linux | linux_kernel | >= 0 < 4.19.37-4 | 4.19.37-4 |
| linux | linux_kernel | >= 0 < 4.15.0-50.54 | 4.15.0-50.54 |
| linux | linux_kernel | >= 4.10 < 4.14.123 | 4.14.123 |
| linux | linux_kernel | >= 4.15 < 4.19.47 | 4.19.47 |
| linux | linux_kernel | >= 4.20 < 5.0.20 | 5.0.20 |
| linux | linux_kernel | >= 4.5 < 4.9.181 | 4.9.181 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.9HIGHAV:A/AC:M/Au:N/C:C/I:C/A:C
osv8.3HIGH
vendor_debian7.9HIGH
vendor_redhat7.9HIGH
vendor_ubuntu5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p2g8-8j8x-3728: An issue was discovered on Broadcom Wi-Fi client devices
ghsa_unreviewed·2022-05-24·CVSS 7.9
CVE-2019-15126 [HIGH] GHSA-p2g8-8j8x-3728: An issue was discovered on Broadcom Wi-Fi client devices
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
GHSA
GHSA-6jhq-h73f-x439: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow
ghsa_unreviewed·2022-05-24·CVSS 7.9
CVE-2019-9500 [HIGH] CWE-787 GHSA-6jhq-h73f-x439: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
Kernel
fortify: Detect struct member overflows in memcpy() at compile-time
kernel_security·2021-04-20
CVE-2019-0145 fortify: Detect struct member overflows in memcpy() at compile-time
fortify: Detect struct member overflows in memcpy() at compile-time
memcpy() is dead; long live memcpy()
tl;dr: In order to eliminate a large class of common buffer overflow
flaws that continue to persist in the kernel, have memcpy() (under
CONFIG_FORTIFY_SOURCE) perform bounds checking of the destination struct
member when they have a known size. This would have caught all of the
memcpy()-related buffer write overflow flaws identified in at least the
last three years.
Background and analysis:
While stack-based buffer overflow flaws are largely mitigated by stack
canaries (and similar) features, heap-based buffer overflow flaws continue
to regularly appear in the kernel. Many classes of heap buffer overflows
are mitigated by FORTIFY_SOURCE when using the strcpy() family of
functions, b
OSV
CVE-2019-9500: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow
osv·2020-01-16·CVSS 8.3
CVE-2019-9500 [HIGH] CVE-2019-9500: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
OSV
linux-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
osv·2019-05-15·CVSS 5.6
[MEDIUM] linux-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
linux-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
USN-3981-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local
OSV
linux-hwe, linux-azure vulnerabilities
osv·2019-05-14·CVSS 5.6
[MEDIUM] linux-hwe, linux-azure vulnerabilities
linux-hwe, linux-azure vulnerabilities
USN-3980-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.
This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu
18.04 LTS.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local attacker could use this to expose
sensitive information. (CVE-2018-12130)
Brandon F
OSV
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-05-14·CVSS 5.6
[MEDIUM] linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local attacker could use this to expose
sensitive information. (CVE-2018-12130)
Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan
van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kave
Red Hat
linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation
vendor_redhat·2020-02-05·CVSS 3.1
CVE-2019-15126 [LOW] CWE-358 linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation
linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
Statement: This issue is present in the Broadcom Wi-Fi client devices firmware and is not fixable in software. While Red Hat ships certain hardware firmware binary blobs via linux-firmware package we rely on the hardware vendors to populate (and document) these firmware binary blobs
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2019-05-15·CVSS 5.6
CVE-2018-12126 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3981-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process tha
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-05-14·CVSS 5.6
CVE-2018-12126 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local attacker could use this to expose
sensitive information. (CVE-2018-12130)
Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan
van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh
Razavi,
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2019-05-14·CVSS 5.6
CVE-2018-12126 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3980-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.
This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu
18.04 LTS.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local attacker could
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-05-14·CVSS 5.6
CVE-2019-11683 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local attacker could use this to expose
sensitive information. (CVE-2018-12130)
Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan
van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh
Razavi,
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-05-14·CVSS 5.6
CVE-2018-12126 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan
Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa
Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos,
Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss
discovered that memory previously stored in microarchitectural fill buffers
of an Intel CPU core may be exposed to a malicious process that is
executing on the same CPU core. A local attacker could use this to expose
sensitive information. (CVE-2018-12130)
Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan
van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh
Razavi,
Red Hat
kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results
vendor_redhat·2019-02-19·CVSS 7.9
CVE-2019-9500 [HIGH] CWE-122 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results
kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
If the Wake-up on Wire
Debian
CVE-2019-9500: linux - The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d...
vendor_debian·2019·CVSS 7.9
CVE-2019-9500 [HIGH] CVE-2019-9500: linux - The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d...
The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
Scope: local
bookworm: resolved (fixed in 4.19.37-4)
bullseye: resolved (fixed in 4.19.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-15126 linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation
bugzilla·2020-02-27·CVSS 3.1
CVE-2019-15126 [LOW] CVE-2019-15126 linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation
CVE-2019-15126 linux-firmware: Transmission of data encrypted with an all-zero session key after disassociation
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
References:
https://www.zdnet.com/article/new-kr00k-vulnerability-lets-attackers-decrypt-wifi-packets/
https://www.welivesecurity.com/wp-content/uploads/2020/02/ESET_Kr00k.pdf
https://www.eset.com/int/kr00k/
Discussion:
Statement:
This issue is present in the Broad
Bugzilla
CVE-2019-9500 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results [fedora-all]
bugzilla·2019-04-18·CVSS 7.9
CVE-2019-9500 [HIGH] CVE-2019-9500 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results [fedora-all]
CVE-2019-9500 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppor
Bugzilla
CVE-2019-9500 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results
bugzilla·2019-04-18·CVSS 7.9
CVE-2019-9500 [HIGH] CVE-2019-9500 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results
CVE-2019-9500 kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results
If the Wake-up on Wireless LAN functionality is configured in the brcmfmac driver which only works with Broadcom FullMAC chipsets, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results() function. This vulnerability can be exploited by compromised chipsets to compromise the host, or when used in combination with another brcmfmac driver flaw (CVE-2019-9503), can be used remotely. This can result in a remote denial of service (DoS). Due to the nature of the flaw, a remote privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Introduced in:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3021ad9a4f00926
arXiv
Streamlining Attack Tree Generation: A Fragment-Based Approach
arxiv_fulltext·2023-10-01
Streamlining Attack Tree Generation: A Fragment-Based Approach
AttackGraph
basicstyle= ,
keywords=AttackTarget, AttackStep,
keywordstyle=blue ,
ndkeywords=OR, CPE, CWE, cweNotes, BaseScore, ImpactScore, ExploitabilityScore, epss, description, CVE, CVSS, SAND ,
ndkeywordstyle=darkgray ,
alsoletter=CVE-, CVSS:, CWE-
identifierstyle=black,
sensitive=false,
comment=[l]//,
morecomment=[s]/**/,
commentstyle=purple ,
stringstyle=red ,
morestring=[b]',
morestring=[b]",
tabsize=2
AttackGrammar
basicstyle= ,
keywords=AttackTreeElement, AttackTarget, AttackStep, Model, AttackTreeModel, SubTree, Gate, AttackTreeSubElements, AttackTree, Synonyms, CVSSVECTORList, ScoreList,
keywordstyle=blue ,
ndkeywords=cwe, name, cpe, synonyms, cvss, note, baseScore, impactScore, exploitabilityScore, epss, attackTree, trigger, primary, numberOfDisrubtions, description, gate, pro
https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.htmlhttps://git.kernel.org/linus/1b5e2423164b3670e8bc9174e4762d297990deffhttps://kb.cert.org/vuls/id/166939/https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.htmlhttps://git.kernel.org/linus/1b5e2423164b3670e8bc9174e4762d297990deffhttps://kb.cert.org/vuls/id/166939/
2020-01-16
Published