New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 1314 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Sep 2017
Cc:



Sign in to add a comment

Apple: OOB NUL byte write when handling WLC_E_TRACE event packets

Reported by laginimaineb@google.com, Jun 28 2017

Issue description

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe" driver is used in order to handle the PCIe interface and low-level communication protocols with the Wi-Fi SoC (also referred to as "dongle"). Similarly, the "AppleBCMWLANCore" driver handles the high-level protocols and the Wi-Fi configuration.

When the dongle wishes to notify the host OS of an event, it does so by encoding a special "packet" and transmitting it to the host. These packets have an ether type of 0x886C, and do not contain actual packet data, but rather encapsulate information about events which must be handled by the driver.

One of the supported event packets is the WLC_E_TRACE message, containing a trace sent from the firmware which may be logged or stored by the host. On iOS, these events are handled by the "handleTraceEvent" function in the "AppleBCMWLANCore" driver. Each packet of this type starts with the common event message header (which is 48 bytes long), followed by the message-trace header:

struct msgtrace_hdr {
  uint8	version;
  uint8 trace_type;
  uint16 len;
  uint32 seqnum;
  uint32 discarded_bytes;
  uint32 discarded_printf;
};

Here is a snippet of "handleTraceEvent"'s high-level logic:

int64_t handleTraceEvent(void* this, uint8_t* event_packet) {

  struct msgtrace_hdr hdr;
  memmove(&hdr, event_packet + 48, sizeof(struct msgtrace_header));

  if (hdr.version == 1) {
    ...

    //Is this a MSGTRACE_HDR_TYPE_MSG trace?
    if (hdr.trace_type == 0) {
      event_packet[htons(hdr.len) + 64] = 0;
      ...
    }

    ...
  }
}

As can be seen above, for messages of type 0 no attempt is made to validate the "len" field in the msgtrace header before using it as an index into the event packet. As a result, an attacker controlling the firmware can craft a WLC_E_TRACE event packet with a large msgtrace length field, causing an OOB NUL byte to be written at the attacker-controlled 16-bit offset.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

 
Labels: ID-668027998
Labels: -Restrict-View-Commit CVE-2017-7112
Status: Fixed (was: New)

Sign in to add a comment