Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)
Summary: Project Zero's Gal Beniamini showed that after gaining code execution on Broadcom's Wi-Fi SoC, an attacker can revert Broadcom's is_wlc_event_frame validation patch in firmware RAM and inject arbitrary frames into the host driver's event channel, which supports about 35 event handlers in Android's bcmdhd driver. He also found a WLC_E_PFN_SWC event handler in dhd_handle_swc_evt that allocates a change_array using the firmware-supplied total_count and then memcpy's pkt_count entries into it, a flaw present in all versions and configurations of bcmdhd.
Why it matters: The Wi-Fi chip is treated as trusted, so a single over-the-air compromise of the SoC can chain into kernel code execution on the host - and the hardware design that permits this control remains unmitigated, with no patch to wait for.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026