Vulnerabilities > CVE-2017-11121 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
| NASL family | Misc. |
| NASL id | APPLETV_11.NASL |
| description | According to its banner, the version of Apple TV on the remote device is prior to 11. It is, therefore, affected by multiple vulnerabilities as described in the HT208113 security advisory. Note that only 4th generation models are affected by these vulnerabilities. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 103419 |
| published | 2017-09-22 |
| reporter | This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/103419 |
| title | Apple TV < 11 Multiple Vulnerabilities |
| code | |
Seebug
| bulletinFamily | exploit |
| description | Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. In order to allow fast roaming between access points in a wireless network, the Broadcom firmware supports the Fast BSS Transition feature (IEEE 802.11r-2008 FT), allowing a client to roam between APs in the same mobility domain. When a client decides to roam to a different AP in an FT network (in the same mobility domain), it first performs Authentication and then Reassociation. During the Reassociation process, the client parses the Fast Transition Information Element in order to decrypt and install the embedded GTK. The FT-IE has the following structure: ``` ----------------------------------------------------------------------- | Tag (55) | Length | MIC CTRL | MIC | Anonce | Snonce | Sub-Elements | ----------------------------------------------------------------------- 0 1 2 4 20 52 84 X ``` Where each sub-element has the following structure: ``` --------------------------------------------------------- | Tag | Length | Key Info | Key Length | RSC | Key Data | --------------------------------------------------------- 0 1 2 4 5 13 X ``` (See 802.11-2016, 9.4.2.48 for more information). On the BCM4355C0 SoC with firmware version 9.44.78.27.0.1.56 the Fast Transition Reassociation process is handled by ROM function 0x8462C. This function retrieves the FT-IE from the last association response and parses it in order to extract the GTK. Here is the approximate high-level logic of this function: ``` int function_8462C(...) { ... //Getting the FT-IE uint8_t* ft_ie = bcm_parse_tlvs(..., ..., 55); if (!ft_ie) return 0; //Getting the GTK Sub-Element uint8_t* gtk_subelem = bcm_parse_tlvs(ft_ie + 84, ft_ie[1] - 82, 2); if (!gtk_subelem) return 0; ... //Decrypting the GTK context_struct->gtk_length = gtk_subelem[4]; if (!function_6D8(16, ..., gtk_subelem[1] - 11, gtk_subelem + 13, &context_struct->decrypted_gtk)) { //Installing the GTK function_C9C14(..., context_struct->decrypted_gtk, context_struct->gtk_length, ...); ... } ... } function_6D8(unsigned key_length, char* key, unsigned input_length, char* input, char* output) { ... char buf[0x200]; char buf2[0x8]; //Validating the lengths if ( (key_length - 16) > 16 || ((0x80808000 << (key_length - 16)) & 0x80000000) == 0 || input_length > 0x188 || input_length << 29 ) return 1; //Copying the input into a local stack buffer memcpy(buf2, input, 8); memcpy(buf + 8, input + 8, input_length - 8); //Do AES decryption ... } int function_C9C14(..., char* gtk, int gtk_len, ...) { ... char* key_buffer = malloc(164); ... memcpy(key_buffer + 8, gtk, gtk_len); ... } ``` The function above fails to validate all the length fields in the FT-IE and in the embedded subelement. As a result, an attacker can cause multiple overflows by sending crafted information elements. Here are some possible attacks: 1. The attacker sends a valid FT-IE with an embedded subelement containing a valid length field (gtk_subelem[1]), but with a large crafted value in the key length field (gtk_subelem[4]). Supplying such values will cause the decryption function (0x6D8) to succeed. However, after decrypting the key, function 0xC9C14 will be called in order to install the GTK, using the crafted key length field. Supplying a large value such as 255 in this field will cause the function to copy 255 bytes from the context structure into the heap allocated buffer, whose size is only 164 -- causing a heap overflow. 2. The attacker sends a valid FT-IE with an embedded subelement whose length field (gtk_subelem[1]) is exactly 11. As we can see above, "gtk_subelem[1] - 11" is provided to the decryption function as the "input_length" field. Although the decryption function does perform some validations on the input length field, it fails to ensure that the field is larger than 8. After performing the validations, it calls "memcpy(buf + 8, input + 8, input_length - 8)" in order to copy the input into a stack-allocated buffer. If the input length is zero, "input_length - 8" will underflow, resulting in a large length argument in the memcpy. I'm not sure whether this is exploitable -- if timed correctly, it might be possible to corrupt important values after the stack, such as the global PCIE structure located at the end of RAM, which would allow the attacker to trigger writes into arbitrary locations in the host's memory. This bug can be addressed by validating the GTK subelement length fields. |
| id | SSV:96606 |
| last seen | 2017-11-19 |
| modified | 2017-09-29 |
| published | 2017-09-29 |
| reporter | Root |
| title | Broadcom: Multiple overflows when handling 802.11r (FT) Reassociation Response(CVE-2017-11121) |
References
- http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html
- http://www.securityfocus.com/bid/100984
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1291
- https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html
- https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html
- https://source.android.com/security/bulletin/2017-09-01
- https://support.apple.com/en-us/HT208112
- https://support.apple.com/en-us/HT208113
- https://support.apple.com/HT208112
- https://support.apple.com/HT208113