Dhowr maalmood ka hor, warka ayaa soo ifbaxay in darawallada loo yaqaan 'Broadcom chips wireless' afar nuglaansho ayaa la ogaaday, in u oggolow weerarrada fog in lagu qaado aaladaha ay ku jiraan jajabyadan.
Xaaladda ugu fudud, dayacanka ayaa loo isticmaali karaa diidmada adeegga fog, laakiin dhacdooyinka jilicsanaanta ay ku horumari karto looma reebin taas oo u oggolaanaysa weeraryahan aan la aqoonsan inuu koodhkaaga ku maamulo xuquuqaha Linux isagoo soo diraya baakado si khaas ah loo farsameeyay.
Arrimahan waxaa lagu aqoonsaday xilligii uu Broadcom ka shaqeynayay injineernimada rogaal celinta, halkaas oo Chips u nugul u nugul si ballaadhan loogu adeegsado kombuyuutarrada gacanta, taleefannada casriga ah, iyo aaladaha macaamiisha kala duwan, laga bilaabo SmartTV illaa qalabka IoT.
Gaar ahaan, qalabka loo yaqaan 'Broadcom chips' waxaa loo isticmaalaa taleefannada casriga ah ee shirkadaha soo saara sida Apple, Samsumg iyo Huawei.
Waa in la ogaadaa in Broadcom waxaa la ogeysiiyey nuglaanta bishii Sebtember 2018, laakiin waxay qaadatay qiyaastii 7 bilood (Si kale haddii loo dhigo, Bishan gudaheeda) bilaabida sixitaanno lala kaashaday soo saarayaasha qalabka.
Maxay yihiin dayacanka la ogaaday?
Laba nuglaansho ayaa saameynaya qalabka gudaha iyo suurtagal u oggolow fulinta koodhka nidaamka nidaamka qalliinka loo adeegsaday Chips Broadcom.
Waa maxay Kuu ogolaanayaa weerarada deegaannada aan Linux ahayn (Tusaale ahaan, suurtagalnimada weerar lagu qaado aaladaha Apple, CVE-2019-8564 waa la xaqiijiyay)).
Halkan waxaa muhiim ah in la xoojiyo in qaar ka mid ah Chips-ka loo yaqaan 'Broadcom Wi-Fi' ay yihiin processor gaar ah (ARM Cortex R4 ama M3), kaas oo ka shaqeyn doona isku ekaanshaha nidaamkaaga qalliinka ee hirgelinta 802.11 wireless xarig ah (FullMAC).
Chips ayaa yiri, xakamaysadu waxay bixisaa isdhexgalka nidaamka martida ee qalabka firmware Wi-Fi
Sharaxaadda weerarka:
Si loo helo xakameyn buuxda nidaamka guud ka dib markii FullMAC waxyeello soo gaartey, waxaa la soo jeediyey in la isticmaalo nuglaansho dheeri ah ama marin buuxa loogu helo xusuusta nidaamka jibbaarada qaarkood.
Jajabyada SoftMAC, xirmooyinka wireless-ka ee 802.11 waxaa laga hirgeliyaa dhinaca kontoroolka waxaana ku shaqeeya nidaam processor ah.
Xakameeyayaasha, nuglaanta ayaa ka muuqata labadaba darawalka lahaanshaha ee wl (SoftMAC iyo FullMAC) sida furitaanka furan ee 'brcmfmac' (FullMAC).
Darawalka wl, waxaa la ogaadey laba qulqulo oo kayd ah, kuwaas oo laga faa'iideysto marka barta marinku u diro fariimo si gaar ah loo farsameeyey oo EAPOL ah inta lagu gudajiro geedi socodka gorgortanka iskuxirka (weerar ayaa lagu qaadi karaa iyadoo lagu xirayo barta marinka xun)
Xaaladda jab ah ee SoftMAC, nuglaanta ayaa u horseedda isu-tanaasul kernel-ka nidaamka, iyo haddii ay tahay FullMAC, koodhku wuxuu ku socon karaa dhinaca qalabka.
Gudaha brcmfmac, waxaa kujira buufin xad dhaaf ah iyo qalad hubinta looxyada la shaqeeyay, kuwaas oo looga faa'iideysto soo dirista looxyada xakamaynta. In Linux kernel, dhibaatooyinka darawalka brcmfmac ayaa la hagaajiyay bishii Febraayo.
Dayacanka la aqoonsaday
Afarta nugul ee la shaaciyay tan iyo bishii Sebtember ee sanadkii hore, durba waxay ku qoran yihiin CVE-yada soo socda.
CVE-2019-9503
Akhlaaqda qaldan ee darawalka brcmfmac marka la shaqeynayo muraayadaha xakamaynta ee loo adeegsado la falgalka qalabka.
Haddii shey leh dhacdo firmware ah uu ka yimaado ilo dibedda ah, kantaroolaha ayaa iska tuuraya, laakiin haddii dhacdada laga helo baska gudaha, jirku waa la iska indha tirayaa.
Dhibaatadu waa taas dhacdooyinka ka imanaya aaladaha isticmaalaya USB-ga ayaa lagu gudbiyaa baska gudaha, taas oo u oggolaanaysa kuwa wax weeraraya inay si guul leh ugu wareejiyaan qalabka kaas oo xukuma looxyada kiiska isticmaalka adabtarada bilaa USB-ka ah;
CVE-2019-9500
Markaad dhaqaajiso hawsha "Ku soo kicinta on Wireless LAN", waxay sababi kartaa qulqulka ee koontaroolka brcmfmac (function brcmf_wowl_nd_results) oo diraya qaab xakameyn gaar ah wax laga beddelay.
Jilicsanaantaas waxaa loo isticmaali karaa in lagu abaabulo fulinta koodhka martida ka dib hawlgelinta jab ama isku dhafan.
CVE-2019-9501
Kaydka ayaa ku qulqulaya wl darawalka wlc_wpa_sup_eapol), kaas oo dhaca inta lagu guda jiro ka shaqeynta farriinta, waxyaabaha ku jira macluumaadka soo saaraha ee ka badan 32 bytes.
CVE-2019-9502
Kaydka ayaa ku qulqulaya wade wl wl__wpa_plumb_gtk function), kaas oo dhaca inta lagu guda jiro ka shaqeynta farriinta, waxa ku jira goobta macluumaadka soo saaraha ee ka badan 164 bytes.
source: https://blog.quarkslab.com