Bug 1166116 – VUL-0: CVE-2019-9502: broadcom-wl: heap buffer overflow in wlc_wpa_plumb_gtk of the Broadcom wl WiFi driver

Bug 1166116 - (CVE-2019-9502) VUL-0: CVE-2019-9502: broadcom-wl: heap buffer overflow in wlc_wpa_plumb_gtk of the Broadcom wl WiFi driver

(CVE-2019-9502)
Summary:	VUL-0: CVE-2019-9502: broadcom-wl: heap buffer overflow in wlc_wpa_plumb_gtk ...

Status:	RESOLVED INVALID

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P5 - None Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-03-09 17:11 UTC by Wolfgang Frisch
Modified:	2020-03-09 17:13 UTC (History)
CC List:	0 users

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Wolfgang Frisch 2020-03-09 17:11:09 UTC

CVE-2019-9502

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the
vendor information element data length is larger than 164 bytes, a heap buffer
overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by
sending specially-crafted WiFi packets, a remote, unauthenticated attacker may
be able to execute arbitrary code on a vulnerable system. More typically, this
vulnerability will result in denial-of-service conditions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9502
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9502
https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html
https://kb.cert.org/vuls/id/166939/

Comment 1 Wolfgang Frisch 2020-03-09 17:12:38 UTC

SUSE does not ship the broadcom-wl driver.