Buffer overflow

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204...

Stack overflow

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205...

iPhone 7 and Samsung Galaxy S7 Wi-Fi Chip Hack Vulnerability

Exploit for hardware platform in category remote exploits Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to t...

CVE-2017-11120: Improper Restriction of Operations within the Bounds of a Memory Buffer

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204...

CVE-2017-11121: Improper Restriction of Operations within the Bounds of a Memory Buffer

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205...

CVE-2017-11121

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205...

CVE-2017-11120

CVE-2017-11120 affects Broadcom BCM4355C0 Wi‑Fi firmware. An attacker can send crafted 802.11k Neighbor Report Responses (NRREP) to trigger a heap-based buffer overrun in the Wi‑Fi firmware, via an overflow in NRREP data handling and an exploitable NRREP/BA interaction primitive. The exploit reli...

CVE-2017-11121

CVE-2017-11121 affects Broadcom BCM4355C0 Wi‑Fi chips (and related devices). Malicious over‑the‑air Fast Transition frames can trigger internal Wi‑Fi firmware heap and/or stack overflows, potentially causing denial of service or other effects. Documents specify the root cause as memory corruption...

CVE-2017-11120

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204...

Remote Wi-Fi Attack Backdoors iPhone 7

Google on Tuesday disclosed details and a proof-of-concept exploit for a Wi-Fi firmware vulnerability in Broadcom chipsets patched this week in iOS 11. The attack enables code execution and persistent presence on a compromised device. “The exploit gains code execution on the Wi-Fi firmware on the...

Google Researcher Publishes PoC Exploit for Apple iPhone Wi-Fi Chip Hack

You have now another good reason to update your iPhone to newly released iOS 11—a security vulnerability in iOS 10 and earlier now has a working exploit publicly available. Gal Beniamini, a security researcher with Google Project Zero, has discovered a security vulnerability CVE-2017-11120 in...

Broadcom 802.11r (FT) Reassociation Response Overflows Vulnerability

Broadcom suffers from multiple overflow vulnerabilities when handling 802.11r FT Reassociation Response. Broadcom: Multiple overflows when handling 802.11r FT Reassociation Response CVE-2017-11121 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. Thes...

Broadcom 802.11v WNM Sleep Mode Response Heap Overflow Vulnerability

Broadcom suffers from a heap overflow vulnerability when handling 802.11v WNM Sleep Mode Response. Broadcom: Heap overflow when handling 802.11v WNM Sleep Mode Response CVE-2017-7065 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are...

Apple iOS 10.2 - Broadcom Out-of-Bounds Write when Handling 802.11k Neighbor Report Response

Apple iOS 10.2 - Broadcom Out-of-Bounds Write when Handling 802.11k Neighbor Report Response Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1289 The exploit gains code execution on the Wi-Fi firmware on the iPhone 7. The exploit has been tested against the Wi-Fi firmware as...

Apple iOS 10.2 - Broadcom Out-of-Bounds Write when Handling 802.11k Neighbor Report Response

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1289 The exploit gains code execution on the Wi-Fi firmware on the iPhone 7. The exploit has been tested against the Wi-Fi firmware as present on iOS 10.2 14C92, but should work on all versions of iOS up to 10.3.3 included. However...

Apple Out-Of-Bounds NUL Byte Write Vulnerability

Exploit for macOS platform in category dos / poc Apple: OOB NUL byte write when handling WLCETRACE event packets CVE-2017-7112 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are...

Apple setVendorIE Heap Overflow / Information Disclosure Vulnerabilities

Exploit for macOS platform in category dos / poc Apple: Heap overflow and information disclosure in "setVendorIE" when handling ioctl results CVE-2017-7110 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile device...

Apple AppleBCMWLANCore Driver Heap Overflow Vulnerability

Exploit for macOS platform in category dos / poc Apple: Heap Overflow in AppleBCMWLANCore driver when handling Completed Firmware Timestamp messages 0x27 CVE-2017-7103 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both...

Apple PCIe Message Ring Protocol Race Conditions Vulnerability

Exploit for macOS platform in category dos / poc Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read CVE-2017-7115 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile...

Apple WLC_E_COUNTRY_CODE_CHANGED Information Leak Vulnerability

Exploit for macOS platform in category dos / poc Apple: Information Leak when handling WLCECOUNTRYCODECHANGED event packets CVE-2017-7116 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi router...