3 ms·

It looks a lot like this google project zero bug (same reporter, same bug type (stack overflow on the wifi chip)) but the CVE number has the last two digits swa

by 0x0 10y ago

It looks a lot like this google project zero bug (same reporter, same bug type (stack overflow on the wifi chip)) but the CVE number has the last two digits swapped https://bugs.chromium.org/p/project-zero/issues/detail?id=1051 https://bugs.chromium.org/p/project-zero/issues/detail?id=10... Looks like it's hitting android devices as well as ios devices? Edit: Apple must have known when they released iOS 10.3.0 since they named the next-day-beta 10.3.2. Perhaps they were embargoed because of other broadcom customers, but didn't want to delay the other crazy security fixes that 10.3.0 brought. Were they forced to ship an known insecure broadcom firmware because of Android then? Double edit: Or more likely they just wanted to get some more testing time. Looks like the p0 bug was unrestricted on Mar 23.

jeroenhd 10y ago
Very interesting to note: > However, searching a small sample of firmwares I have present, I've been able to verify the existence of the "ccx" tag in the Galaxy S7 (G930F, G930V), Galaxy S6 Edge (G925V), Galaxy S7 Edge (G935F, G9350), Galaxy Note 4 (N910F) and Galaxy S5 (G900F). This could mean that not only Apple devices are affected. Broadcom chips are everywhere and bringing out patches and firmware update is a big problem in the Android world.
tedunangst 10y ago
Well, it's quite obvious to see what went wrong. void function_79390(void* unk, char* ie, char* buf) Those are terrible names for functions and variables. Very shoddy development.
- jeroenhd 10y ago
  This is probably decompiled code. Many functions loose their names if code gets optimized or obfuscated. function_XYZ is probably a placeholder used by the decompiler.
  - ccrush 10y ago
    Yes. Def hexrays/Ida
  - johncolanduoni 10y ago
    I'm 99% certain it was a joke...
ben1040 10y ago
>Looks like it's hitting android devices as well as ios devices? The April Android security bulletin went out today and there were several new Broadcom wifi related vulnerabilities addressed on it too. https://source.android.com/security/bulletin/2017-04-01.html https://source.android.com/security/bulletin/2017-04-01.html

by 0x0 10y ago

jeroenhd 10y ago

Very interesting to note: > However, searching a small sample of firmwares I have present, I've been able to verify the existence of the "ccx" tag in the Galaxy S7 (G930F, G930V), Galaxy S6 Edge (G925V), Galaxy S7 Edge (G935F, G9350), Galaxy Note 4 (N910F) and Galaxy S5 (G900F). This could mean that not only Apple devices are affected. Broadcom chips are everywhere and bringing out patches and firmware update is a big problem in the Android world.

tedunangst 10y ago

Well, it's quite obvious to see what went wrong. void function_79390(void* unk, char* ie, char* buf) Those are terrible names for functions and variables. Very shoddy development.

jeroenhd 10y ago
This is probably decompiled code. Many functions loose their names if code gets optimized or obfuscated. function_XYZ is probably a placeholder used by the decompiler.
- ccrush 10y ago
  Yes. Def hexrays/Ida
- johncolanduoni 10y ago
  I'm 99% certain it was a joke...

ben1040 10y ago

>Looks like it's hitting android devices as well as ios devices? The April Android security bulletin went out today and there were several new Broadcom wifi related vulnerabilities addressed on it too. https://source.android.com/security/bulletin/2017-04-01.html https://source.android.com/security/bulletin/2017-04-01.html