CVE-2017-6956 in Wi-Fi HardMAC SoC
Summary
by MITRE
On the Broadcom Wi-Fi HardMAC SoC with fbt firmware, a stack buffer overflow occurs when handling an 802.11r (FT) authentication response, leading to remote code execution via a crafted access point that sends a long R0KH-ID field in a Fast BSS Transition Information Element (FT-IE).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2020
The vulnerability identified as CVE-2017-6956 represents a critical stack buffer overflow flaw within Broadcom Wi-Fi HardMAC SoCs that operate with fbt firmware implementations. This vulnerability specifically manifests during the handling of 802.11r Fast BSS Transition authentication responses, where the device fails to properly validate the length of the R0KH-ID field contained within the Fast BSS Transition Information Element. The flaw exists at the intersection of wireless protocol implementation and memory management, creating a pathway for remote code execution that can be exploited through malicious wireless access points.
The technical implementation of this vulnerability stems from insufficient bounds checking within the firmware's processing of Fast BSS Transition frames. When a malicious access point crafts an FT-IE with an excessively long R0KH-ID field, the receiving Broadcom Wi-Fi device attempts to copy this data into a fixed-size stack buffer without proper length validation. This classic buffer overflow condition allows an attacker to overwrite adjacent stack memory, potentially corrupting return addresses and function pointers. The vulnerability is particularly dangerous because it operates at the hardware firmware level, making traditional software-based mitigations ineffective and requiring low-level firmware updates for remediation.
The operational impact of CVE-2017-6956 extends beyond simple remote code execution, as it provides attackers with complete control over affected devices. The vulnerability affects a wide range of Broadcom Wi-Fi chipsets that implement the fbt firmware, including various mobile devices, laptops, and IoT devices that rely on these components for wireless connectivity. An attacker positioned within wireless range of an affected device can exploit this vulnerability without requiring any user interaction or authentication, making it particularly dangerous in public wireless environments or corporate networks. The remote code execution capability enables attackers to install malware, exfiltrate data, or establish persistent backdoors on compromised devices, effectively compromising the entire wireless communication stack.
Mitigation strategies for this vulnerability require immediate firmware updates from device manufacturers, as the flaw exists at the hardware firmware level and cannot be addressed through software patches alone. Network administrators should implement wireless network monitoring to detect malicious access points that may be exploiting this vulnerability, while also considering network segmentation to limit the potential impact of successful exploitation. The vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which is classified as a high-risk weakness in the Common Weakness Enumeration catalog, and represents a technique that attackers might employ through the ATT&CK framework's T1059.007 sub-technique for Command and Scripting Interpreter. Organizations should also consider implementing network access control measures and wireless intrusion detection systems to identify and block malicious wireless traffic that may contain crafted FT-IE frames designed to exploit this buffer overflow condition.