PT-2019-9936 · Broadcom · Broadcom Firmware

Daniele Antonioli + 2 · Publicado 2019-06-07 · Atualizado 2020-08-24 · CVE-2018-19860

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Broadcom firmware versions prior to summer 2014

Description The issue is related to the improper restriction of LMP commands in Broadcom firmware, which can lead to the execution of certain memory contents upon receiving an LMP command. This can be demonstrated by executing an HCI command. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Broadcom firmware versions prior to summer 2014, consider disabling the execution of LMP commands as a temporary workaround until a patch is available. Restrict access to the vulnerable firmware to minimize the risk of exploitation. Avoid using the LMP command in the affected devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-19860

Produtos afetados

Broadcom Firmware

Referências · 9

• https://osv.dev/vulnerability/CVE-2018-19860 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19860 · Nota de Segurança
• https://broadcom.com/support/resources/product-security-center · Aviso do Fabricante
• https://source.android.com/security/bulletin/2019-05-01 · Nota
• https://t.me/cibsecurity/4766 · Publicação no Telegram
• https://seclists.org/bugtraq/2019/Aug/21 · Nota
• https://support.apple.com/kb/HT210348 · Nota
• http://seclists.org/fulldisclosure/2019/Jul/22 · Nota
• http://seclists.org/fulldisclosure/2019/Aug/11 · Nota