by qkaiser_ 17 hours ago

I probably need to adapt the wording then.

Broadcom released an insufficient patch in 2018, then they moved to hostapd in their SDK. So as an OEM you can get the support of Broadcom to move to a fixed revision.

The whole issue is not that Broadcom has a bug, everyone has, it’s that their communication did not make its way down the supply chain.

They said they notified OEMs but refused to share the content with me. So we don’t know whether it was a single line in a changelog or an actual security advisory.

Since every OEM is not keeping track of all vendor communications, a proper CVE would have alerted the OEMs to take action 8 years ago I think.

simoncion 7 hours ago

> I probably need to adapt the wording then.

Yeah. I'd recommend changing

  A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.

to something like

  A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by a new version of their SDK which replaced the vulnerable components with hostapd. Broadcom recommended to move to this new SDK version, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.

It makes it clear that Broadcom supplied a fixed version that uses hostapd, rather than making it seem like vendors might have been required to do the migration to hostapd themselves.

fock 16 hours ago

could you also mention which driver this is somewhere? I deduct it is the proprietary broadcom-driver, so only used in routers? Also what happens if you turn WPS off?