Broadcom wl WiFi Driver Vendor Information wlc_wpa_plumb_gtk WiFi Packet heap-based overflow

Summaryinfo

A vulnerability was found in Broadcom wl WiFi Driver. It has been rated as critical. This vulnerability affects the function wlc_wpa_plumb_gtk of the component Vendor Information Handler. Performing a manipulation as part of WiFi Packet results in heap-based overflow. This vulnerability is known as CVE-2019-9502. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in Broadcom wl WiFi Driver (Hardware Driver Software) (version unknown). This affects the function wlc_wpa_plumb_gtk of the component Vendor Information Handler. The manipulation as part of a WiFi Packet leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

The bug was discovered 04/17/2019. The weakness was published 02/03/2020. This vulnerability is uniquely identified as CVE-2019-9502 since 03/01/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 292 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-149624. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Hardware Driver Software

Vendor

• Broadcom

Name

• wl WiFi Driver

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion