Vulnerability Note VU#160027

Broadcom BCM4325 and BCM4329 wireless chipset denial-of-service vulnerability

Original Release date: 23 Oct 2012 | Last revised: 28 Jan 2013

Overview

Broadcom BCM4325 and BCM4329 wireless chipsets have been reported to contain an out-of-bounds read error condition that may be exploited to produce a denial-of-service condition.

Description

The CORE Security Technologies advisory states:

    "An out-of-bounds read error condition exists in broadcom's BCM4325 and BCM4329 combo solutions firmware. This error can be leveraged to denial of service attack, and possibly information disclosure. An attacker can send a RSN (802.11i) information element, that causes the WiFi NIC to stop responding."

Broadcom's official response is:
    "CORE Security Technologies has identified a Denial-of-Service (DoS) vulnerability in the firmware running on two prior generation Broadcom chips, the BCM4325 and BCM4329. Other Broadcom chips are not affected. This denial of service attack can cause an unpatched consumer electronics device to experience a WLAN service interruption. The vulnerability does not enable exposure of the consumer's data. Broadcom has firmware patches for its OEM customers to address the issue.

    The vast majority of Broadcom's WLAN product portfolio is not subject to the DoS issue, including as examples:
    • Broadcom's subsequent generations of Mobility WLAN devices, e.g., BCM4330, BCM4334, BCM43241, BCM43340, BCM4335;
    • Broadcom's products for the PC and Media market, e.g., BCM4313, BCM43142, BCM43224, BCM43228, BCM4331, BCM43236, BCM4352, BCM43526, BCM4360;
    • Broadcom's Access Point WLAN devices and products, e.g., BCM4718, BCM535x, BCM4706;

    Broadcom has been working with multiple customers providing information and fixes as required, and will continue to address security issues that may be identified."
Additional details can be found in the CORE Security Technologies advisory.

Impact

A remote attacker may be able to cause a denial-of-service condition against the WiFi network interface card.

Solution

Apply an Update

Users of devices with Broadcom BCM4325 or BCM4329 wireless chipsets should contact their vendor to acquire a patch.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Apple Inc.Affected22 Aug 201228 Jan 2013
BroadcomAffected22 Aug 201223 Oct 2012
HTCAffected22 Aug 201223 Oct 2012
Motorola, Inc.Unknown22 Aug 201222 Aug 2012
NokiaUnknown22 Aug 201222 Aug 2012
Sony CorporationUnknown22 Aug 201222 Aug 2012
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 6.1 AV:A/AC:L/Au:N/C:N/I:N/A:C
Temporal 4.8 E:POC/RL:OF/RC:C
Environmental 4.8 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Andres Blanco and Matias Eissler for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs: CVE-2012-2619
  • Date Public: 23 Oct 2012
  • Date First Published: 23 Oct 2012
  • Date Last Updated: 28 Jan 2013
  • Document Revision: 31

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.