CVE-2019-9503

The Broadcom brcmfmac WiFi driver prior to commit
a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame
validation bypass. If the brcmfmac driver receives a firmware event frame
from a remote source, the is_wlc_event_frame function will cause this frame
to be discarded and unprocessed. If the driver receives the firmware event
frame from the host, the appropriate handler is called. This frame
validation can be bypassed if the bus used is USB (for instance by a wifi
dongle). This can allow firmware event frames from a remote source to be
processed. In the worst case scenario, by sending specially-crafted WiFi
packets, a remote, unauthenticated attacker may be able to execute
arbitrary code on a vulnerable system. More typically, this vulnerability
will result in denial-of-service conditions.

Notes