Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code

https://nvd.nist.gov/vuln/detail/CVE-2017-9417

by rnhmjoj • 9 years ago

220 42 9 years ago

nvd.nist.gov

qume• 9 years ago

Love my macbook pro (linux), but the broadcom chips are such a pain. Almost enough me to drop Apple hardware.

I think this has pushed me over the edge.

rcarmo• 9 years ago

Have you actually read the CVE and articles? This is not Apple-specific at all...

asdfaoeu• 9 years ago

I think he's just saying that broadcom is the only option with macbooks.

pier25• 9 years ago

No, but Apple uses a lot of Broadcom chips

osivertsson3• 9 years ago

What Wi-Fi chip vendor would be preferable then?

Broadcom's Wi-Fi chip solution has now been the focus of many man-months of security analysis, but I'm not aware of any other vendor that has seen the same thorough analysis, or?

Is any Wi-Fi chip vendor actively marketing themselves as security oriented and has anything to show to back that up?

itchy_eyelids• 9 years ago

I agree. I have an older Macbook Pro from 2010 and none of the Linux drivers, b43 or Broadcom's wl, can get anything better than 17Mbps to my access point. If I boot from Mac OS, I get 70Mbps. They also can't do 4-addr bridging and are missing some other features. Add to that all of the ACPI problems and it makes for a very poor Linux experience.

osivertsson3• 9 years ago

More info is available here:

http://boosterok.com/blog/broadpwn/ http://boosterok.com/blog/broadpwn2/

ethbro• 9 years ago

Previous discussion: https://news.ycombinator.com/item?id=14727400

43224gg252• 9 years ago

So since this is in the firmware is it safe to assume that this affects all devices with the broadcom chip, regardless of what OS they're running?

swsieber• 9 years ago

Mostly. If this is the same thing that was posted in the last month or so, then it's possible for it be patched. Whether it's the firmware itself or through a mitigation technique in the OS, I can't remember. The last time it was posted, it was mostly about phones, and there was an update for Android phones that "fixed" the bug. The status of the bug on iOS was unknown.

It may be that the bug is easily defendable against at the OS level if one knows that it could be present.

Edit: Somebody else posted the previous discussion, so I think it's the bug I'm thinking of.

ajross• 9 years ago

In general the firmware for these devices is loaded by the OS at startup, so the OS simply patches the firmware file. Checking the linux-firmware tree for what I presume to be the same devices, though, I see a few recent commits to a handful of files, but nothing that looks like it might be a fix to this issue:

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...

qb45• 9 years ago

Probably not all BCM43xx devices are affected, though. This product line spans over 10 years and all 802.11 revisions since a/b with various firmwares and internal CPUs, from custom cores to ARM.

The issue likely exists in a limited number of chips, possibly only FullMAC ones, like similar bug found earlier by Google:

https://googleprojectzero.blogspot.com/2017/04/over-air-expl...

edit:

Actually NIST lists the vulnerable NICs: BCM4354, BCM4358, BCM4359.

osivertsson3• 9 years ago

NIST's list is incomplete, at least BCM43570 is vulnerable as well [1]. I would expect many more Broadcom chips to be vulnerable even if exploits may need to be tweaked.

[1] I'm part of a team that develops a product with this chip, and I've used the hostapd configuration I linked elsewhere in this topic to show it is vulnerable.

0x02• 9 years ago

It feels like we just had another massive wifi firmware exploit not too long ago. iOS 10.3.1 / CVE-2017-6975 / CVE-2017-6956 / https://bugs.chromium.org/p/project-zero/issues/detail?id=10...

ryanlol• 9 years ago

This is because these things are full of bugs, previously it's just been fewer people looking.

TekMol• 9 years ago

Does this affect laptops running Linux? How do you know if you are vurnurable?

tarruda• 9 years ago

If you have broadcom wifi, then probably you are

avh02• 9 years ago

googling for solutions/patches/fixes for ubuntu don't seem to yield much (though that doesn't give me much confidence). I wonder if it's just drowning in the noise about android/ios

tyingq2• 9 years ago

This should show if you have a BCM43xxx device:

$ lspci | grep -i BCM43

AdmiralAsshat• 9 years ago

Linux laptops should be fine--no one can ever get Broadcom working on Linux anyway.

nthcolumn• 9 years ago

Was at Blackhat https://www.blackhat.com/us-17/briefings.html#broadpwn-

by @nitayart

jwildeboer2• 9 years ago

Will be at blackhat ;-) July 22 is not today ...

andridk• 9 years ago

Are there any tools out yet, to patch and check if your vulnerable?

ktta• 9 years ago

Best way is to google your phone model and see if it is in the list of affected devices list. Or you can get the chip's details by prodding with the adb shell.

If you are the adventurous type, this[1] comment has links to the blog post which has a PoC.

[1] https://news.ycombinator.com/item?id=14776192

jwildeboer2• 9 years ago

Seems to be fixed in Android July security update. Not sure wrt iPhone, iPad.

tempay• 9 years ago

It was fixed in ios 10.3.1 (3rd April) https://support.apple.com/en-us/HT207688

0x02• 9 years ago

Is that the same bug, or a different one, though?

IshKebab2• 9 years ago

I hope someone will write a very visible worm that spreads via unpatched Android phones (approximately all of them) and finally forces Google to take updates seriously.

Can anyone see a reason this wouldn't work?

johncolanduoni• 9 years ago

The fact tha Google is pretty timely with updates, and if this happened the manufacturers would be content with letting the malware push people towards earlier upgrades?

cptskippy• 9 years ago

What do you hope such an attack would achieve? Giving Apple more market share?

Apple controls the iPhone soup to nuts and can update them as they see fit. They are the OEM and they do not allow Carriers to modify their devices.

Google provides an OS for free and stipulates that OEMs must make some concessions to get the GAPPs everyone wants for that OS. It has no where near the control over handsets or the ability to update them without cooperation from OEMs and Carriers who contracted with those OEMs.

With each new version of Android, Google is asking for more and more control over the system however they'll never own the devices or be able to exert their will the way Apple can.

Attacking field devices won't spur Google to ship magic updates to everyone's unsupported handsets because they couldn't even if they wanted to. It might spur them to make additional changes in future OS versions but the vast majority of handsets in the field would never receive those updates.

bitmapbrother2• 9 years ago

Fortunately, your dream will never come true. Remember Stagefright? Whatever happened to that? Oh, that's right nothing ever happened. There hasn't been one reported case of Stagefright in the wild according to Google's telemetry of over 2 Billion Android devices that use GMS.

Finding an exploit is one thing, making it work and bypassing all of the OS mitigations, on a platform that essentially has OEM's build their own OS, is an entirely different matter. It's why Stagefright never got anywhere and it's also why this will go the same way Stagefright did.

anfractuosity2• 9 years ago

I haven't looked into how the exploit works in detail, but could this affect the RaspberryPi 3?

userbinator2• 9 years ago

No. Same company, completely different products.

anfractuosity2• 9 years ago

Ah interesting, doesn't the Pi 3 use the same wifi chipset though? I think the Pi uses BCM43438. I'm not sure if all 43x chips use the same firmware.

userbinator2• 9 years ago

Note that Cypress acquired these from Broadcom and have opened up a lot of the documentation. There's still quite a lot of info not present, and they might still be going through and renaming them, but maybe if you ask... either way, a surprisingly pleasing result in contrast to the notoriously closed attitude before.

cmurf• 9 years ago

I've got a Macbook Pro from 2011 with BCM4331. So there must be a metric f ton of hardware affected.

The firmware is embedded in the closed source drivers, it's not available separately. It's uncertain how far back Broadcom will update their driver packages.

On Linux if you want to use the open source driver, either the distro or user must extract the firmware from the closed source driver using b43-fwcutter. I don't know what the license restrictions are that apply to distros that appear to include it in the base installs, and therefore probably get updated. But distros like Fedora don't include it due to license restrictions. Therefore it won't get updated automatically.

I think the kernel driver should warn, if not refuse to use without a force option, on firmware versions below a certain value.

iokevins• 9 years ago

One device specification resource:

http://www.devicespecifications.com/

Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code

Related Stories