REDHAT-BUG-1701842
First published: Mon Apr 22 2019(Updated: )
If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and not be processed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed and this can result in denial of service (DoS) condition. Introduced in: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=5b435de0d786869c95d1962121af0d7df2542009">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=5b435de0d786869c95d1962121af0d7df2542009</a> An upstream patch: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=a4176ec356c73a46c07c181c6d04039fafa34a9f">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=a4176ec356c73a46c07c181c6d04039fafa34a9f</a> External References: <a href="https://kb.cert.org/vuls/id/166939/">https://kb.cert.org/vuls/id/166939/</a> <a href="https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9503-remotely-sending-firmware-events-bypassing-is-wlc-event-frame">https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9503-remotely-sending-firmware-events-bypassing-is-wlc-event-frame</a> <a href="https://www.bleepingcomputer.com/news/security/broadcom-wifi-driver-flaws-expose-computers-phones-iot-to-rce-attacks/">https://www.bleepingcomputer.com/news/security/broadcom-wifi-driver-flaws-expose-computers-phones-iot-to-rce-attacks/</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| brcmfmac driver |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=5b435de0d786869c95d1962121af0d7df2542009
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=a4176ec356c73a46c07c181c6d04039fafa34a9f
- https://kb.cert.org/vuls/id/166939/
- https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html#cve-2019-9503-remotely-sending-firmware-events-bypassing-is-wlc-event-frame
- https://www.bleepingcomputer.com/news/security/broadcom-wifi-driver-flaws-expose-computers-phones-iot-to-rce-attacks/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1701843
- https://access.redhat.com/security/cve/CVE-2019-8564
- https://access.redhat.com/errata/RHSA-2019:2703
- https://access.redhat.com/errata/RHSA-2019:2741
- https://access.redhat.com/security/cve/cve-2019-9503
- https://access.redhat.com/errata/RHSA-2020:1016
- https://access.redhat.com/errata/RHSA-2020:1070
- https://access.redhat.com/errata/RHSA-2020:2522
- https://bugzilla.redhat.com/show_bug.cgi?id=1701842
Frequently Asked Questions
What is REDHAT-BUG-1701842?
REDHAT-BUG-1701842 is a vulnerability related to the Broadcom brcmfmac driver where firmware event frames from a remote source are discarded, potentially allowing for security risks.
What software is affected by REDHAT-BUG-1701842?
The Broadcom brcmfmac driver is the affected software for REDHAT-BUG-1701842.
How do I fix REDHAT-BUG-1701842?
The fix for REDHAT-BUG-1701842 involves applying the latest updates or patches provided for the Broadcom brcmfmac driver.
What is the impact of REDHAT-BUG-1701842?
The impact of REDHAT-BUG-1701842 may include the inability to properly process certain firmware event frames, leading to potential security vulnerabilities.
Is there a workaround for REDHAT-BUG-1701842?
There is no specific workaround for REDHAT-BUG-1701842; updating the driver is recommended to mitigate the vulnerability.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9503
- agent/source
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/broadcom
- canonical/brcmfmac driver