Exploit the possiblities

Broadcom wldev_ioctl Information Leak

Broadcom wldev_ioctl Information Leak
Posted May 23, 2017
Authored by Google Security Research, laginimaineb

Broadcom suffers from a host to dongle information leak via wldev_ioctl.

tags | advisory
advisories | CVE-2017-0633
MD5 | 4920ccd54f1c8e49e101f7bf4b8b956b

Broadcom wldev_ioctl Information Leak

Change Mirror Download
 Broadcom: Information Leak from Host to Dongle via "wldev_ioctl" 


Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On Android devices, the "bcmdhd" driver is used in order to communicate with the Wi-Fi SoC (also referred to as "dongle").

Along with the regular flow of frames transferred between the host and the dongle, the two communicate with one another via a set of "ioctls" which can be issued to read or write dongle configuration from the host. This information is exchanged using the SDIO "control" channel (SDPCM_CONTROL_CHANNEL) rather than the regular "data" and "glom" channels (which are used to transfer frames).

When the "bcmdhd" driver wishes to send a ioctl to the dongle, it does so by calling "wldev_ioctl". This function has the following signature:

s32 wldev_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set)

Where "arg" is a pointer to the argument supplied to the ioctl call, and "len" indicates the length of this argument. This function transfers the supplied buffer over SDIO to the dongle, where it is handled by the dongle's ioctl handler function.

The "bcmdhd" driver issues many such ioctls, either when accessing iovars, or when reading and writing configuration used by the dongle. However, in all of these cases, "bcmdhd" neglects to clear the unused memory in the supplied argument buffer before calling "wldev_ioctl". As a result, the buffers transferred via the ioctl calls contain uninitialised memory, including pointers and other information processed by the driver.

To demonstrate this issue, I've located the needed symbols on the Nexus 6P (NUF26K, BCM4358 version The dongle's ioctl handler is at located at ROM address 0x19734, and the pointer to the registered ioctl handler is located in RAM address 0x214BF0. By patching the RAM address to point to a newly allocated code stub, we are able to intercept the ioctl handler on the dongle.

I've written a small code stub which instruments the ioctl handler in order to dump the contents of the buffers passed in by the host. Here's a small sample of these log dumps:

(1237) ioctl - code: 262, length: 512
(1238) 0 : 6f737361
(1239) 4 : 65725f63
(1240) 8 : 65695f71
(1404) 148 : ffffffc0
(1405) 152 : 00cdd204
(1406) 156 : ffffffc0
(1407) 160 : 5bd4b6f0
(1408) 164 : ffffffc0
(1409) 168 : 003ee868
(1410) 172 : ffffffc0
(1411) 176 : 5bd4b7e0
(1412) 180 : ffffffc0
(1413) 184 : 5bd4b810
(1414) 188 : ffffffc0
(1415) 192 : 5bd4b790
(1416) 196 : ffffffc0

As can be seen in the log above, the buffer contains multiple pointers from the host's kernel. This issue can be addressed by clearing the unused memory in the passed in argument buffers prior to calling "wldev_ioctl".

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

Found by: laginimaineb


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By