Vulnerabilities > CVE-2019-15126 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in multiple products
Attack vector
ADJACENT_NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
LOW Integrity impact
NONE Availability impact
NONE Summary
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leveraging Race Conditions via Symbolic Links This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to her. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file she will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.
- Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
Exploit-Db
| id | EDB-ID:48233 |
| last seen | 2020-03-19 |
| modified | 2020-03-18 |
| published | 2020-03-18 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/48233 |
| title | Broadcom Wi-Fi Devices - 'KR00K Information Disclosure |
Nessus
| NASL family | MacOS X Local Security Checks |
| NASL id | MACOS_HT210722.NASL |
| description | The remote host is running a version of macOS or Mac OS X that is 10.15.x prior to 10.15.1, 10.14.x prior to 10.14.6 security update 2019-001, 10.13.x prior to 10.13.6 security update 2019-006. It is, therefore, affected by multiple vulnerabilities : - An out-of-bounds read error exists in the accounts component due to improper input validation. A remote attacker can exploit this, to disclose memory contents. (CVE-2019-8787) - A security bypass vulnerability exists in the App Store component due to an improper state management implementation. A local attacker can exploit this, to login to the account of a previously logged in user without valid credentials. (CVE-2019-8803) - An out-of-bounds read error exists in the IOGraphics component due to improper bounds checking. A local attacker can exploit this, to cause unexpected system termination or to read kernel memory. (CVE-2019-8759) Note that Nessus has not tested for this issue but has instead relied only on the operating system |
| last seen | 2020-03-18 |
| modified | 2019-11-13 |
| plugin id | 130967 |
| published | 2019-11-13 |
| reporter | This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/130967 |
| title | macOS 10.15.x < 10.15.1 / 10.14.x < 10.14.6 Security Update 2019-001 / 10.13.x < 10.13.6 Security Update 2019-006 |
| code | |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/156809/broadcomwifi-disclose.txt |
| id | PACKETSTORM:156809 |
| last seen | 2020-03-19 |
| published | 2020-03-19 |
| reporter | Maurizio Siddu |
| source | https://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html |
| title | Broadcom Wi-Fi KR00K Proof Of Concept |
The Hacker News
| id | THN:C75DD7C8E99DFE4FF4F7D8CC001C67E5 |
| last seen | 2020-02-26 |
| modified | 2020-02-26 |
| published | 2020-02-26 |
| reporter | The Hacker News |
| source | https://thehackernews.com/2020/02/kr00k-wifi-encryption-flaw.html |
| title | New Wi-Fi Encryption Vulnerability Affects Over A Billion Devices |
Related news
References
- https://support.apple.com/kb/HT210721
- https://support.apple.com/kb/HT210722
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-wi-fi-info-disclosure
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0001
- http://www.huawei.com/en/psirt/security-notices/huawei-sn-20200228-01-kr00k-en
- https://support.apple.com/kb/HT210788
- https://www.mist.com/documentation/mist-security-advisory-kr00k-attack-faq/
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt
- https://www.synology.com/security/advisory/Synology_SA_20_03
- http://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-wifi-en
- https://cert-portal.siemens.com/productcert/pdf/ssa-712518.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-20-224-05