Issue metadata
Sign in to add a comment
|
Security: Broadcom WiFi firmware vulnerabilities CVE-2017-11122 CVE-2017-11120 |
|||||||||||||||||||||||||||||||||
Issue descriptionTwo more firmware vulnerabilities. One of them allows an OOB write to the firmware heap, so can be potentially exploited to achieve code execution in the firmware context. Only mitigating factor is that our bcm 4354 chips don't have DMA capability, so the attacker can't trivially escalate to full system compromise. Setting Severity-High, Impact-Stable. We'll require an updated firmware binary from Broadcom to fix this.
,
Sep 6 2017
,
Sep 7 2017
,
Sep 8 2017
firmware release change list : 1. V2017062001 - NDOE missing IPv6 payload length check 2. V2017061204 - Neighbor Report IE Validation 3. V2017061401 - Fix for integer overflow and missing length check during md ie length caclulation Thanks. Terry
,
Sep 11 2017
CL is here: https://chromium-review.googlesource.com/c/chromiumos/third_party/linux-firmware/+/657760
,
Sep 12 2017
Issue 760549 has been merged into this issue.
,
Sep 12 2017
Issue 761785 has been merged into this issue.
,
Sep 12 2017
Filing merge requests here after merging bugs. CL still pending at https://chromium-review.googlesource.com/c/chromiumos/third_party/linux-firmware/+/657760
,
Sep 12 2017
This bug requires manual review: Request affecting a post-stable build Please contact the milestone owner if you have questions. Owners: amineer@(Android), cmasso@(iOS), ketakid@(ChromeOS), govind@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 12 2017
Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 12 2017
,
Sep 12 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/linux-firmware/+/343fb0c700335650183edd0f6ed46a3ebc01501e commit 343fb0c700335650183edd0f6ed46a3ebc01501e Author: Mattias Nissler <mnissler@chromium.org> Date: Tue Sep 12 20:03:22 2017 Update brcmfmac4354 firmware to version 7.81.3 BUG= chromium:762487 TEST=WiFi connection successful with new firmware. Change-Id: I7c4dd309cb55aa0577c8d13e165e658e84a89cc5 Reviewed-on: https://chromium-review.googlesource.com/657760 Commit-Ready: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Kevin Cernekee <cernekee@chromium.org> [modify] https://crrev.com/343fb0c700335650183edd0f6ed46a3ebc01501e/brcm/brcmfmac4354-sdio.bin
,
Sep 12 2017
Approving merge to M61 and M62. Please merge to M62 before you merge to M61. Please explore an M60 option with Josafat if the timelines do not work for you.
,
Sep 12 2017
aashutoshk@ - please sanity test a Broadcom 4354 device with this fix.
,
Sep 13 2017
Your change meets the bar and is auto-approved for M62. Please go ahead and merge the CL to branch 3202 manually. Please contact milestone owner if you have questions. Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/linux-firmware/+/3ab674a3be97a52df9325a67a1c0512757302cf7 commit 3ab674a3be97a52df9325a67a1c0512757302cf7 Author: Mattias Nissler <mnissler@chromium.org> Date: Wed Sep 13 09:54:02 2017 Update brcmfmac4354 firmware to version 7.81.3 BUG= chromium:762487 TEST=WiFi connection successful with new firmware. Change-Id: I11aa11b6f6f98f5aa595b2052176d1c3c449fb26 Reviewed-on: https://chromium-review.googlesource.com/663868 Reviewed-by: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> [modify] https://crrev.com/3ab674a3be97a52df9325a67a1c0512757302cf7/brcm/brcmfmac4354-sdio.bin
,
Sep 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/linux-firmware/+/e36184bb1f25c3471b3280134853038a2a5a0b07 commit e36184bb1f25c3471b3280134853038a2a5a0b07 Author: Mattias Nissler <mnissler@chromium.org> Date: Wed Sep 13 09:56:13 2017 Update brcmfmac4354 firmware to version 7.81.3 BUG= chromium:762487 TEST=WiFi connection successful with new firmware. Change-Id: I11aa11b6f6f98f5aa595b2052176d1c3c449fb26 Reviewed-on: https://chromium-review.googlesource.com/663869 Reviewed-by: Mattias Nissler <mnissler@chromium.org> Tested-by: Mattias Nissler <mnissler@chromium.org> [modify] https://crrev.com/e36184bb1f25c3471b3280134853038a2a5a0b07/brcm/brcmfmac4354-sdio.bin
,
Sep 13 2017
Merged to 62 and 61.
,
Sep 13 2017
,
Sep 13 2017
,
Sep 19 2017
An M60 refresh seems possible now, so filing formal merge request to make sure this is on Josafat's radar.
,
Sep 19 2017
I've been holding off on a merge because there are still a few more patches under review, would appreciate a +2 (or reply on the public list with comments): https://chromium-review.googlesource.com/q/topic:%22brcmfmac-762487%22+(status:open%20OR%20status:merged)
,
Sep 19 2017
I did test minnie canary this past weekend and verified that the patches currently in the tree did not totally break wifi.
,
Sep 20 2017
,
Oct 18 2017
,
Dec 7 2017
,
Dec 20 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 25 2018
,
Mar 7 2018
,
Apr 19 2018
,
May 30 2018
,
Jul 25
,
Sep 5
,
Oct 17
,
Dec 5
,
Dec 6
Dropping stale merge request in an attempt to silence sheriffbot |
||||||||||||||||||||||||||||||||||
►
Sign in to add a comment |
||||||||||||||||||||||||||||||||||
Comment 1 by sheriffbot@chromium.org
, Sep 6 2017