PT-2024-10762 · Broadcom+1 · Broadcom Wireless Combo Chips+1

Francesco Gringoli + 1 · Published 2024-11-10 · Updated 2024-11-26 · CVE-2020-10369

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cypress (and Broadcom) Wireless Combo chips versions prior to the January 2021 firmware update

Description The issue allows inferences about memory content via a "Spectra" attack when a January 2021 firmware update is not present. This affects certain Cypress (and Broadcom) Wireless Combo chips.

Recommendations For Cypress (and Broadcom) Wireless Combo chips versions prior to the January 2021 firmware update, apply the January 2021 firmware update to mitigate the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-10369

Affected Products

Broadcom Wireless Combo Chips

Cypress Wireless Combo Chips

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2020-10369 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10369 · Vendor Advisory
• https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a · Note
• https://informatik.tu-darmstadt.de/seemoo/team_seemoo/jiska_classen/index.en.jsp · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2052676 · Note
• https://twitter.com/transilienceai/status/1856752082373808304 · Twitter Post
• https://twitter.com/transilienceai/status/1856751992456302665 · Twitter Post
• https://twitter.com/transilienceai/status/1856752041257046212 · Twitter Post
• https://twitter.com/transilienceai/status/1856752067702096255 · Twitter Post
• https://twitter.com/CVEnew/status/1855754666023489546 · Twitter Post
• https://t.me/cvedetector/10440 · Telegram Post
• https://informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp · Note
• https://t.me/cvenotify/101246 · Telegram Post
• https://t.me/cvenotify/101252 · Telegram Post
• https://twitter.com/transilienceai/status/1856751985002958927 · Twitter Post