CVE-2025-21750 wifi: brcmfmac: Check the return value of of_property_read_string_index()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the return value of ofpropertyreadstringindex Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unchecked ofpropertyreadstringindex return value in the brcmfmac driver, which could lead to a crash...

PT-2025-8862

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.10 through 6.11 Description A vulnerability in the Linux kernel has been identified, specifically in the brcmfmac driver. The issue arises when the of property read string index function returns an uninitialized value,...

SUSE CVE-2024-35811

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmfcfg80211detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to star...

The vulnerability of the `brcmfmac/cfg80211.c` file within the wireless communication driver module `brcm80211` in the `drivers/net/wireless/broadcom` directory of the Linux kernel allows a malicious actor to cause a system failure.

The vulnerability of the brcmfmac/cfg80211.c file within the wireless communication driver module brcm80211 in the drivers/net/wireless/broadcom directory of the Linux kernel is related to the use of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a system...

kernel: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Fix a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strreplace in...

kernel: USB-accessible buffer overflow in brcmfmac

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges...

The vulnerability of the brcmf_get_assoc_ies() function in the driver drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c of the Linux kernel allows a attacker to access protected information or cause a service failure.

The vulnerability of the brcmfgetassocies function in the driver drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c of the Linux kernel is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to access protected...

PT-2023-34923 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.11 Description: The issue is related to out-of-bounds reads in the wifi brcmfmac driver. It is noted that the actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kerne...

GSD-2023-1001347 brcmfmac: return error when getting invalid max_flowrings from dongle

brcmfmac: return error when getting invalid maxflowrings from dongle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

OESA-2022-2103 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: VUL-0: CVE-2022-3628: kernel: USB-accessible buffer overflow in Linux kernel driver brcmfmacCVE-2022-3628...

PT-2022-35496 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: A use-after-free bug was found in the brcmf netdev start xmit function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior...

PT-2022-35295 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: The issue is related to an invalid address access when enabling SCAN log level in the brcmfmac wifi driver. The actual impact and attack plausibility have not yet been proven...

openSUSE Security Update : bcm43xx-firmware (openSUSE-2020-1560)

This update for bcm43xx-firmware fixes the following issues : - Update bluetooth firmware to address Sweyntooth and Spectra issues bsc1176631 : - brcmfmac driver loads file depending on compatible. Rename files correspondingly. bsc1169094 This update was imported from the SUSE:SLE-15-SP2:Update...

openSUSE: Security Advisory for bcm43xx-firmware (openSUSE-SU-2020:1560-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for bcm43xx-firmware (moderate)

openSUSE Security Update: Security update for bcm43xx-firmware Announcement ID: openSUSE-SU-2020:1560-1 Rating: moderate References: 1169094 1176631 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for bcm43xx-firmware fix...

SUSE-SU-2020:2733-1 Security update for bcm43xx-firmware

This update for bcm43xx-firmware fixes the following issues: - Update bluetooth firmware to address Sweyntooth and Spectra issues bsc1176631: - brcmfmac driver loads file depending on compatible. Rename files correspondingly. bsc1169094...

kernel: brcmfmac frame validation bypass

If the brcmfmac driver receives a firmware event frame from a remote source, the iswlceventframe function will cause this frame to be discarded and not be processed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be...

CVE-2019-9500

If the Wake-up on Wireless LAN functionality is configured in the brcmfmac driver, which only works with Broadcom FullMAC chipsets, a malicious event frame can be constructed to trigger a heap buffer overflow in the brcmfwowlndresults function. This vulnerability can be exploited by compromised...

kernel: brcmfmac frame validation bypass

If the brcmfmac driver receives a firmware event frame from a remote source, the iswlceventframe function will cause this frame to be discarded and not be processed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be...