95 matches found
kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level
A NULL pointer dereference vulnerability was found in the Broadcom brcmfmac wireless driver in the Linux kernel. When the SCAN debug log level is enabled, a loop variable 'i' is incorrectly modified when setting random MAC addresses. This causes an invalid memory access when attempting to print...
OESA-2023-1212 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: Kernel: A denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.cCVE-2023-28328 A slab-out-of-bound read problem was found in brcmfgetassocies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ...
CVE-2023-1380
A slab-out-of-bound read problem was found in brcmfgetassocies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when associnfo-reqlen data is bigger than the size of the buffer, defined as WLEXTRABUFMAX, leading to a denial of service...
SUSE CVE-2023-1380
A slab-out-of-bound read problem was found in brcmfgetassocies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when associnfo-reqlen data is bigger than the size of the buffer, defined as WLEXTRABUFMAX, leading to a denial of service...
USN-5919-1 linux-aws-hwe, linux-oracle vulnerabilities
It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...
SUSE CVE-2017-7541
The brcmfcfg80211mgmttx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service buffer overflow and system crash or possibly gain privileges via a crafted NL80211CMDFRAME Netlink packet...
SUSE CVE-2019-9502
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlcwpaplumbgtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated...
SUSE CVE-2019-15126
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a...
SUSE CVE-2020-10367
Certain Cypress and Broadcom Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack...
SUSE CVE-2020-10368
Certain Cypress and Broadcom Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack...
Broadcom brcmfmac WiFi Kernel Buffer Overflow Information Disclosure
The vulnerability of the iswlceventframe function in the Broadcom brcmfmac WiFi driver for Linux operating systems is related to insufficient input data validation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information and compromise its integrity and...
CVE-2019-20546
An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 Broadcom Wi-Fi chipsets software. A denial-of-service attack can leverage a shared interface between Broadcom Bluetooth and Broadcom Wi-Fi. The Samsung ID is SVE-2019-15350 November 2019...
CVE-2019-15126
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a...
CVE-2019-9502
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlcwpaplumbgtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated...
Microsoft HoloLens Remote Code Execution Vulnerabilities
Executive Summary Microsoft is aware of vulnerabilities that affect the Broadcom wireless chipset included in the Microsoft HoloLens device. The vulnerabilities could allow an unauthenticated attacker in physical proximity to cause a denial of service condition or execute code on a target system...
PT-2017-12945
Name of the Vulnerable Software and Affected Versions Android kernel Description The issue is related to an elevation of privilege vulnerability in the Broadcom wireless driver. Recommendations For Android kernel, apply the patch referenced by Android ID A-63930471 to resolve the issue...
CVE-2017-13161: Undefined Security Weakness
An elevation of privilege vulnerability in the Broadcom wireless driver. Product: Android. Versions: Android kernel. Android ID A-63930471. References: BC-V2017092501...
Broadcom Wi-Fi Driver Privilege Escalation
The vulnerability of Broadcom’s Wi-Fi driver for the Android operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
CVE-2017-0791
A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37306719. References: B-V2017052302...
Broadcom Wi-Fi Driver Privilege Escalation
The vulnerability of Broadcom’s Wi-Fi driver in the Android operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a local attacker to increase their privileges...