I also wonder if this affects MacBooks? Some of them, at the very least, ship with "Card: AirPort Extreme, Firmware version: Broadcom BCM43xx" according to System Information.
Edit: Also, speculating on the impact. Is it possible that an attacker can construct a device that can spam unauthenticated wifi frames that will be interpreted by devices in the pockets of passersby, triggering a buffer overflow, gaining RCE in the wifi chip, and then use DMA or somesuch to read out all main system memory, or maybe even write an RCE shellcode to the main operating system? Sounds pretty deadly if your device can get rooted automatically just by being nearby another device. Glad this was found by Google Project Zero and responsibly disclosed, hopefully the bad guys haven't found anything similar :O :)
1 comment
[ 3.0 ms ] story [ 14.4 ms ] threadI also wonder if this affects MacBooks? Some of them, at the very least, ship with "Card: AirPort Extreme, Firmware version: Broadcom BCM43xx" according to System Information.
Edit: Also, speculating on the impact. Is it possible that an attacker can construct a device that can spam unauthenticated wifi frames that will be interpreted by devices in the pockets of passersby, triggering a buffer overflow, gaining RCE in the wifi chip, and then use DMA or somesuch to read out all main system memory, or maybe even write an RCE shellcode to the main operating system? Sounds pretty deadly if your device can get rooted automatically just by being nearby another device. Glad this was found by Google Project Zero and responsibly disclosed, hopefully the bad guys haven't found anything similar :O :)