CVE-2019-9500 Broadcom brcmfmac driver is vulnerable to a heap buffer overflow

High 7.9 Published 16 Jan 2020 Updated 4 Aug 2024

A heap buffer overflow in the Broadcom brcmfmac WiFi driver allows remote code execution or denial of service if Wake-on-LAN is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-9500?

CVE-2019-9500 is a high-severity memory corruption vulnerability in Linux kernel, published on 16 Jan 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2019-9500?

It affects 2 products.

Linux distribution packages (40)

`kernel-devel` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:3.10.0-957.41.1.el7`
`kernel-headers` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:3.10.0-957.41.1.el7`
`perf` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:3.10.0-957.41.1.el7`
`python-perf` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:3.10.0-957.41.1.el7`
`kpatch-patch-3_10_0-1062` Red Hat:enterprise_linux:7::server	All versions	`0:1-2.el7`
`kpatch-patch-3_10_0-1062-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1-2.el7`
`bpftool` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debug` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debug-devel` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-devel` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-doc` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-headers` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-tools` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-tools-debuginfo` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-tools-libs` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`kernel-tools-libs-devel` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`perf` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`perf-debuginfo` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`python-perf` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`python-perf-debuginfo` Red Hat:rhel_eus:7.6::computenode	All versions	`0:3.10.0-957.41.1.el7`
`bpftool` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-bootwrapper` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debug` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debug-devel` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo-common-ppc64` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo-common-ppc64le` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo-common-s390x` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-devel` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-doc` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`
`kernel-headers` Red Hat:rhel_eus:7.6::server	All versions	`0:3.10.0-957.41.1.el7`

Products include Broadcom Brcmfmac Driver, Linux kernel.

How do I fix CVE-2019-9500?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-9500 being exploited?

There is no known exploitation of CVE-2019-9500 in the wild and no public exploit code.

CVE-2019-9503 Broadcom brcmfmac driver is vulnerable to a frame validation bypass High 7.9

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-9500, GHSA-6jhq-h73f-x439, RHSA-2019:2945, RHSA-2019:4168, RHSA-2019:4171, UBUNTU-CVE-2019-9500.