Vulnerability Note VU#160027

The CORE Security Technologies advisory states:

"An out-of-bounds read error condition exists in broadcom's BCM4325 and BCM4329 combo solutions firmware. This error can be leveraged to denial of service attack, and possibly information disclosure. An attacker can send a RSN (802.11i) information element, that causes the WiFi NIC to stop responding."

"CORE Security Technologies has identified a Denial-of-Service (DoS) vulnerability in the firmware running on two prior generation Broadcom chips, the BCM4325 and BCM4329. Other Broadcom chips are not affected. This denial of service attack can cause an unpatched consumer electronics device to experience a WLAN service interruption. The vulnerability does not enable exposure of the consumer's data. Broadcom has firmware patches for its OEM customers to address the issue.

The vast majority of Broadcom's WLAN product portfolio is not subject to the DoS issue, including as examples:

• Broadcom's subsequent generations of Mobility WLAN devices, e.g., BCM4330, BCM4334, BCM43241, BCM43340, BCM4335;
• Broadcom's products for the PC and Media market, e.g., BCM4313, BCM43142, BCM43224, BCM43228, BCM4331, BCM43236, BCM4352, BCM43526, BCM4360;
• Broadcom's Access Point WLAN devices and products, e.g., BCM4718, BCM535x, BCM4706;

Broadcom has been working with multiple customers providing information and fixes as required, and will continue to address security issues that may be identified."

A remote attacker may be able to cause a denial-of-service condition against the WiFi network interface card.

Apply an Update

Users of devices with Broadcom BCM4325 or BCM4329 wireless chipsets should contact their vendor to acquire a patch.