Ezinsukwini ezimbalwa ezedlule, kwavela izindaba zokuthi kutholakale ubuthakathaka obune kubashayeli bama-chip angenantambo e-Broadcom , okuvumela ukuhlaselwa okukude kumadivayisi aqukethe lawa ma-chip.
Esimweni esilula kakhulu, ubuthakathaka bungasetshenziswa ekwenqatshweni kwesevisi kude, kodwa izimo lapho ubuthakathaka bungathuthukiswa khona obuvumela umhlaseli ongaqinisekisiwe ukuthi asebenzise ikhodi yakhe ngamalungelo e-kernel ye-Linux ngokuthumela amaphakethe aklanywe ngokukhethekile azikhishwa ngaphandle.
Lezi zinkinga zatholakala ngesikhathi sobunjiniyela obuhlukile be-firmware ye-Broadcom, lapho ama-chip asengozini yokuba sengozini esetshenziswa kabanzi kuma-laptop, ama-smartphone, kanye namadivayisi ahlukahlukene abathengi, kusukela kuma-Smart TV kuya kumadivayisi e-IoT.
Ikakhulu, ama-chip we-Broadcom asetshenziswa kuma-smartphones wabakhiqizi abanjengo-Apple, uSamsumg noHuawei.
Kuyaphawuleka ukuthi i-Broadcom yaziswa ngobuthakathaka ngoSepthemba 2018, kodwa kwathatha cishe izinyanga ezi-7 (okungukuthi, kule nyanga kuphela) ukukhipha ukulungiswa okuhlanganiswe nabakhiqizi bemishini.
Yini ubuthakathaka obutholakele?
Ubuthakathaka obubili buthinta i-firmware yangaphakathi futhi bungase buvumele ukwenziwa kwekhodi endaweni yokusebenza yesistimu esetshenziswa kuma-chip e-Broadcom.
Lokhu kuvumela izindawo zokuhlasela ezingasebenzisi i-Linux (isibonelo, kungenzeka ukuthi kuhlaselwe amadivayisi e-Apple, i-CVE-2019-8564 iqinisekisiwe)).
Lapha kubalulekile ukugcizelela ukuthi amanye ama-chip we-Broadcom Wi-Fi ayiprosesa ekhethekile (i-ARM Cortex R4 noma i-M3), ezosebenzisa ukufana kwesistimu yakho yokusebenza kusukela ekusetshenzisweni kwesitaki sayo esingenantambo esingu-802.11 (i-FullMAC).
Kula ma-chip, isilawuli sinikeza ukusebenzisana kwesistimu eyinhloko ne -firmware ye-chip ye-Wi-Fi .
Encazelweni yokuhlaselwa:
Ukuthola ukulawula okugcwele kohlelo oluphambili ngemuva kokuthi i-FullMAC yonakalisiwe, kuhlongozwa ukusebenzisa ubungozi obengeziwe noma ukufinyelela okugcwele kwimemori yohlelo kwamanye ama-chips.
Kuma-chip eSoftMAC, isitaki esingenantambo esingu-802.11 senziwa ohlangothini lwesilawuli futhi siqhutshwa yi-CPU yesistimu.
Kubashayeli, ubuthakathaka bubonakala kokubili kumshayeli we-wl ozimele (i-SoftMAC ne-FullMAC) kanye ne-brcmfmac evulekile (i-FullMAC).
Kumshayeli we-wl, kutholakala ukugcwala okuningana kwe-buffer, kuxhashazwe lapho indawo yokungena ithumela khona imilayezo eyenziwe ngobuhlakani ye-EAPOL ngesikhathi senqubo yezingxoxo zokuxhuma (ukuhlaselwa kungenziwa ngokuxhuma endaweni yokungena enonya).
Endabeni ye-chip eneSoftMAC, ukuba sengozini kuholela ekuyekethiseni kohlelo lwekernel, futhi esimweni seFullMAC, ikhodi ingasebenza ohlangothini lwe-firmware.
Ku-brcmfmac, kunokugcwala kwe-buffer nephutha ekuhloleni amafreyimu acutshunguliwe, asetshenziswa ngokuthumela amafreyimu wokulawula. Ku-Linux kernel, izinkinga kumshayeli we-brcmfmac zalungiswa ngoFebhuwari.
Ukuba sengozini okukhonjiwe
Ubuthakathaka obune obethulwe obala kusukela ngoSepthemba wonyaka odlule manje sebubhalwe ngaphansi kwe-CVE elandelayo.
I-CVE-2019-9503
Ukuziphatha okungalungile komshayeli we-brcmfmac lapho kucubungulwa amafreyimu wokulawula asetshenziselwa ukuxhumana ne-firmware.
Uma ifreyimu enomcimbi we-firmware ivela kumthombo wangaphandle, isilawuli siyasilahla, kepha uma umcimbi utholwa ngebhasi langaphakathi, ifreyimu ayinakwa.
Inkinga ukuthi izehlakalo ezivela kumadivayisi asebenzisa i-USB zidluliselwa ngebhasi langaphakathi, okuvumela abahlaseli ukuthi badlulise ngempumelelo i-firmware elawula ozimele uma kusetshenziswa ama-adaptha angenantambo e-USB;
I-CVE-2019-9500
Uma usebenzisa umsebenzi we- "Wake-up on Wireless LAN" , kungabangela ukugcwala kwesilawuli se-brcmfmac (umsebenzi we-brcmf_wowl_nd_results) ngokuthumela uhlaka lokulawula olushintshiwe ngokukhethekile.
Lokhu kusengozini kungasetshenziswa ukuhlela ukwenziwa kwekhodi ohlelweni oluyinhloko ngemuva kokuyekethisa kwe-chip noma ngokuhlanganiswa.
I-CVE-2019-9501
I-buffer ichichima kudrayivu ye-wl (wlc_wpa_sup_eapol function), eyenzeka ngesikhathi sokucutshungulwa kwemilayezo, okuqukethwe kwenkambu yolwazi lomkhiqizi edlula ama-byte angama-32.
I-CVE-2019-9502
I-buffer ichichima kumshayeli we-wl (wlc_wpa_plumb_gtk function), okwenzeka ngesikhathi sokucutshungulwa kwemilayezo, okuqukethwe kwenkambu yolwazi lomkhiqizi edlula amabhayithi ayi-164.
Umthombo: https://blog.quarkslab.com