CVE-2017-0571

CVE-2017-0571 stems from Broadcom’s Wi‑Fi driver (bcmdhd) on Android. A WLFC TLV parity parsing path fails to validate length fields, allowing an attacker controlling the dongle to craft a TLV with a large length (e.g., 255) which overflows a stack buffer, enabling local code execution in the ker...

Broadcom: Multiple memory corruptions in "bcmdhd" when handling WLFC information (CVE-2017-0571)

Detailed analysis: https://googleprojectzero.blogspot.tw/2017/04/over-air-exploiting-broadcoms-wi-fi4.html https://googleprojectzero.blogspot.tw/2017/04/over-air-exploiting-broadcoms-wi-fi11.html Broadcom produces the Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing...