Firmware Vulnerability In Popular Wi-Fi Chipset Affects Laptops, Smartphones, Routers, Gaming Devices (zdnet.com) 100
Embedi security researcher Denis Selianin has discovered a vulnerability affecting the firmware of a popular Wi-Fi chipset deployed in a wide range of devices, such as laptops, smartphones, gaming rigs, routers, and Internet of Things (IoT) devices. According to Selianin, the vulnerability impacts ThreadX, a real-time operating system that is used as firmware for billions of devices. ZDNet reports: In a report published today, Selianin described how someone could exploit the ThreadX firmware installed on a Marvell Avastar 88W8897 wireless chipset to execute malicious code without any user interaction. The researcher chose this WiFi SoC (system-on-a-chip) because this is one of the most popular WiFi chipsets on the market, being deployed with devices such as Sony PlayStation 4, Xbox One, Microsoft Surface laptops, Samsung Chromebooks, Samsung Galaxy J1 smartphones, and Valve SteamLink cast devices, just to name a few.
"I've managed to identify ~4 total memory corruption issues in some parts of the firmware," said Selianin. "One of the discovered vulnerabilities was a special case of ThreadX block pool overflow. This vulnerability can be triggered without user interaction during the scanning for available networks." The researcher says the firmware function to scan for new WiFi networks launches automatically every five minutes, making exploitation trivial. All an attacker has to do is send malformed WiFi packets to any device with a Marvell Avastar WiFi chipset and wait until the function launches, to execute malicious code and take over the device. Selianin says he also "identified two methods of exploiting this technique, one that is specific to Marvell's own implementation of the ThreadX firmware, and one that is generic and can be applied to any ThreadX-based firmware, which, according to the ThreatX homepage, could impact as much as 6.2 billion devices," the report says. Patches are reportedly being worked on.
"I've managed to identify ~4 total memory corruption issues in some parts of the firmware," said Selianin. "One of the discovered vulnerabilities was a special case of ThreadX block pool overflow. This vulnerability can be triggered without user interaction during the scanning for available networks." The researcher says the firmware function to scan for new WiFi networks launches automatically every five minutes, making exploitation trivial. All an attacker has to do is send malformed WiFi packets to any device with a Marvell Avastar WiFi chipset and wait until the function launches, to execute malicious code and take over the device. Selianin says he also "identified two methods of exploiting this technique, one that is specific to Marvell's own implementation of the ThreadX firmware, and one that is generic and can be applied to any ThreadX-based firmware, which, according to the ThreatX homepage, could impact as much as 6.2 billion devices," the report says. Patches are reportedly being worked on.
Re: (Score:1)
Maybe you should have read the summary?
this is one of the most popular WiFi chipsets on the market, being deployed with devices such as Sony PlayStation 4, Xbox One
That alone is more than 100 million devices.
Re: (Score:1)
Hint: this means the manufacturers using it are embarrassed to advertise it on the box.
Re:Were are Marvell chipsets popular? (Score:5, Informative)
Realtek is the lowest end. Those are the NICs you find on eBay or Amazon for a few bucks that usually have a name randomly generated from a syllable table. You'll also find them rebranded in non-dedicated-IT physical stores for $30. They shift a lot of them because they are the cheapest of the cheap and practically every no-name device has a little RTL crab in it somewhere. Many cheapo all-in-one motherboards have them too and a handful of other integrated devices.
Marvell are still cheap and cheerful but a lot more popular for integrated devices. Marvell not so much for NICs, though I have seen a few. They're a lot more popular in cheap APs and other network devices than RTL as well. A lot more integrated devices are sold these days than discrete NICs.
Atheros, Broadcom and Intel is where midrange (or the low end of enterprise), starts. Atheros and Broadcom do also have a fair representation in the consumer space, but they're seen in the high end enthusiast stuff rather than budget conscious, high volume garbage.
Re: (Score:2)
Realtek is the lowest end.
Many cheapo all-in-one motherboards have them too
Some (most?) of the best motherboards (for builders, overclockers, ect.) has Realtek net and audio. Mine has Realtek and some crappy extras besides what the chipset supports for USB, SATA, net, etc. Those crap ones are Marvell and an Intel NIC that is even worse than going back to token ring. Saying "Intel > Marvell > Realtek" tells me you have no clue what you are talking about. That's like saying a rocket is faster than a spoon. Well not for eating with!
Re: (Score:2)
IIRC, some chipsets (or cards?) offload things like packet checksumming to dedicated silicon, hence reducing CPU load - but I can't remember having seen network traffic ever using any noticeable CPU load?
Re: (Score:2)
Spent over a month researching popular wifi adapters. Not even once dit I find an adapter using any model of chipset from Marvell. So the claim that this chipset model is very popular is bull.
Spent over a month researching the cars parked on the street outside my house. Not even once did I find a car made by Toyota. So the claim that Toyota makes cars is bull.
Don't use wifi (Score:2)
Re:Don't use wifi (Score:4, Funny)
Re: (Score:1)
For actual security, I do all my internet browsing offline, inside a Faraday cage, deep underground in my backyard bunker.
Re: (Score:1)
You can download and browse the entire Wikipedia offline. It all will fit on a medium sized SD card on your phone.
Re: (Score:2)
Funny how the definition of "medium sized SD card" changes with each passing year.
Re: Don't use wifica (Score:1)
Well obviosly, orherwise they would not fit in the slotrs/ readers, I think the poster you responsed to meant capasety not physical size,I often mske that simplifixcation myself since moste storrage nedia comes b a standard form factor (have you for instance seen any sata ssds, not counting m.2 ans pcie ,that where anything other then 2.5inches wide) ? I admit it is technicaly innscurate to say size when you mean capacity, but unfortunatly making people care is about as easy as making the US change to the
Fantasy (Score:2, Insightful)
Patches are reportedly being worked on.
Since when are any of these consumer devices' firmware actually upgradable??
Maybe we need to have manufacturers buy everyone new devices so they'd actually learn their lesson.
Re: (Score:2)
They've been upgradeable for decades.
Re: (Score:2)
Re: (Score:2)
Just drive around with the exploit, and when you have taken control, patch it.
Re: (Score:1)
Re: (Score:2)
I propose "patchdriving".
Re: (Score:2)
Why? I'm sure Sony and Microsoft will update their game consoles - both are supported devices still and can be updated during the next software update that gets pushed out. I'm pretty certain the Microsoft Surface will be updated as well.
Ditto the Chromebook since that gets regular updates.
Maybe
Express Logic Announces THREADX® MISRA Compli (Score:5, Funny)
https://rtos.com/news/express-... [rtos.com]
Once again proving, the only way to safely use C is by only hiring 200 IQ coders who have been developing firmware for 30 years and have never created an exploitable bug in their entire life. Like all the developers who will argue me on this ... there's just not enough of you guys to go around though.
Re: (Score:2)
So by this logic Java is also not safe for anyone to use either, no?. You didn't forget that the massive Equifax hack was due to a remote code execution vulnerability in Apache Struts which is written entirely in Java, right?
https://blogs.apache.org/found... [apache.org]
Re: (Score:1)
Oh and even Heartbleed can claim but a small fraction of the damage that the Struts bug did with the breadth of the Equifax breach.
Re: (Score:2)
Type errors are unavoidable, buffer overflows are unavoidable in (MISRA) C.
Re:Express Logic Announces THREADX® MISRA Com (Score:4, Insightful)
You can interpret data in an incoming packet as code for a domain language in any programming language. There is no language feature which caused this and for which alternatives have been actively researched for decades but held back by curmudgeons.
The same can not be said for buffer overflows.
Re: (Score:1)
[quote]Type errors are unavoidable,[/quote]
And yet in the real world they aren't as numerous CVEs can attest. I can also find numerous other causes of security vulnerabilities due to SQL injection, etc. as well. All in software supposedly written by the cream of the crop of these "safe" languages.
It's almost as if the entire base of your argument is bullshit.
Re: (Score:2)
Oh yeah, SQL has been nearly as destructive as C ... no argument there. The native use of it in web front ends makes certain types of disastrous errors very easy to make.
Re: (Score:3)
You seem to really be obsessing over this issue.
It's like arguing that cars shouldn't have safety belts and airbags, since you can never rule out the chance that you might die of a heart attack wile you're driving.
Re: (Score:2)
the only way to safely use C
I know. Our firmware should be coded by highschoolers using Rust. Then it'll be 100% bug free and safe.
Re: (Score:2)
Firmware relevant to your well-being will get coded by the equivalent of those highschoolers any way. You celebrate the continued use of C and giving those kids all the tools to harm you with. I think the necessity for replacing C in most fields should have been clear to the industry since before the current crop of highschoolers was born.
Re: (Score:2)
Take away people's guns and they'll just stab you. Your notion that if avoid writing in C (especially in low level systems like this) everything will be better is just stupid.
Re: (Score:2)
Stab resistant vests are lighter than bullet resistant ones.
ThreadX RTOS (Score:5, Interesting)
If I'm reading this correctly, the blame for these exploits is being squarely placed on this ThreadX RTOS thing.
Well, you signed up for proprietary operating system, this is what you get when you do that. This is the downside of using code you can't look at and assess yourself, or have it assessed by professionals. You just have to take their word for it that it's security, stable and good. Obviously, this particular proprietary operating system is not secure.
Must say, I'm mildly surprised. Checking out ThreadX RTOS website, they seem to have all sorts of fancy certifications which I have no idea what mean, but surely they mean something? Just not secure and exploit free operating system?
2-4KB of RAM & $300 million risk limits OS cho (Score:5, Interesting)
> they seem to have all sorts of fancy certifications which I have no idea what mean, but surely they mean something?
Mostly they mean that you can depend on it running perfectly reliably, so you can trust your $300 million space probe to ThreadX.
You may have also noticed ThreadX takes 2KB of memory.
When your system requirements are the kind of thing ThreadX is designed for, you don't have a ton of options. Maybe three will be worth considering, and likely one will be the best fit, just on technical considerations.
Re: (Score:3)
It makes me wonder if they really needed an RTOS for this. In my experience often the RTOS is just a crutch for programmers who don't know how to survive without an OS. It's actually needed for what they want to do, and in fact tends to just make things worse.
Of course there are times when you want one. Stuff that takes a long time and which you can't easily break up into smaller steps, which wifi stuff seems like it might be a good fit for.
Re: (Score:3)
Abstraction adds safety. The closer to your hardware you get the more complicated and quirky edge cases you need to handle and debug. The library principle applies here too. e.g. you don't want every idiot reinventing openssl the end result would be very bad. Instead by abstracting yourself and building on the platform of others you have not only reduced the chance of bugs in your code, you've increased consistency between your products and platforms while also dramatically simplifying the process of bug fi
Re: (Score:2)
That works on bigger systems where you have hardware support for abstraction, things like memory protection.
Without it the abstraction doesn't help. A bad pointer can still trash another task. Maybe other tasks can still run even if one hangs, but now you need a two level watchdog system to save that task and to save the OS in case that gets stuck.
As for libraries, sure for openssl, but does openssl need an RTOS just to be ported? And are you going to maintain that port? Makes more sense to shove stuff like
Re: (Score:2)
A bad pointer can still trash another task. Maybe other tasks can still run even if one hangs, but now you need a two level watchdog system to save that task and to save the OS in case that gets stuck.
What we could do is collect all of these functions in a common structure and run it on our hardware. Let's give it a fancy name like "Operating System".
Re: (Score:3)
It makes me wonder if they really needed an RTOS for this.
Running on an RTOS ENORMOUSLY simplifies things when you have multiple, independent (or mostly independent), things you have to manage in real time.
The task or task set managing each of these independent things can be written without regard for any of the other stuff going on, except for those tiny and well-contained places where it must communicate with another task handling something related. Meanwhile the OS handles the resource allocation, sched
Re: (Score:3)
Well, you signed up for proprietary operating system, this is what you get when you do that.
What makes you think that if the OS were non proprietary that the companies in question would have bothered to go through and debug the source code? The many eyes theory has been proven false over and over again in open source.
Have *you* gone through the Linux kernel line by line? Or are you making an assumption that someone, somewhere who is competent has done a good job?
Re: (Score:2)
[quote]The many eyes theory has been proven false over and over again in open source.[/quote]
In fact it has been proven TRUE over and over again in open source. When a project is popular and well used, bugs (which all are security risks; the only difference between them is magnitude) get rooted out very efficiently.
And wifi modules are incredibly popular. If these had been running an open source OS, immense amounts of scrutiny would have been applied.
Sure, unpopular projects and products do not get a lot of
Re: (Score:2)
In fact it has been proven TRUE over and over again in open source. When a project is popular and well used, bugs (which all are security risks; the only difference between them is magnitude) get rooted out very efficiently.
Look just claiming something doesn't make it so. Maybe have data to back it up? I know I know you would struggle to prove a false, but if the CVEs on OpenSSL, and Bash (just to name 2 very high profile cases recently) are anything to go by your statement could not be more wrong.
Now to be fair the bugs are shallow statement is misrepresented. Linus's law specifically talked about beta testing and problems, not covert security vulnerabilities. But the misrepresented version has been proven false over and over
Re: (Score:2)
Linus does not differentiate between bugs and bugs. They are all bugs.
And yes, I did look over open source code.And my employer did, on my recommendation. Some of those applications are now in-house maintained, as they have been abandoned. Others, the patches have been given back to the project.
The point is not that security reviews are performed on open source software. I have not claimed that routinely happens (though companies I have worked for do them all the time). The point is, when I need to use a pr
Re: (Score:1)
I used ThreadX back in the day. Not sure this is still the case but they used to give you a copy of the source code when licensed. It was proprietary but you could definitely look at the source.
Re: (Score:2)
Well, you signed up for proprietary operating system, this is what you get when you do that. This is the downside of using code you can't look at and assess yourself, or have it assessed by professionals.
ThreadX does distribute its source.
From https://en.wikipedia.org/wiki/... [wikipedia.org] ThreadX is distributed using a marketing model in which source code is provided and licenses are royalty-free.
Re: (Score:2)
If I'm reading this correctly, the blame for these exploits is being squarely placed on this ThreadX RTOS thing.
I think you are reading it incorrectly and the summary is misleading. This is NOT a ThreadX bug:
From https://embedi.org/blog/remote... [embedi.org]
So, we have 2 techniques to exploit ThreadX block pool overflow. One is generic and can be applied to any ThreadX-based firmware (in case it has a block pool overflow bug, and the next block is free). **Emphasis on: "in case it has a block pool overflow bug"
Re: (Score:2)
Or to try and jailbreak the console.
Re: (Score:2)
I know, but it is another opportunity to control an interface to the processor.
There was another console that was defeated by a faulty USB stack.
Think of all the fun someone could have being able to send whatever they want into the wireless stack of the main processor after it has been booted.
You're not giving some very smart console hackers credit!
Re: (Score:2)
Anything you can get into that can do DMA can get into the system if they misuse the IOMMU, but if they get that right, the wireless chip seems to be of little value. But maybe you could make it claim to be some other peripheral...
Oh dear (Score:4, Insightful)
Certified by SGS-TUV Saar for use in safety-critical systems and achieved EAL4+ Common Criteria security certification. Oops. There goes your pacemaker.
This is why we need opensource firmware (Score:2)
That's it.
Everyone with this chipset is at risk! (Score:2)
Then proceeds to only list a few devices using that chipset, not a complete list.
What the fuck are we supposed to do with this information?
Wonderful! (Score:2)