Hugues Anguelkov

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.18.9 **Description** A type confusion bug in `nft set elem init` leading to a buffer overflow could be used by a local attacker to escalate privileges. The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP NET ADMIN access. This issue can be fixed in `nft setelem parse data` in `net/netfilter/nf tables api.c`. The exploit uses the unlinking technique and can allow an attacker to gain root access. **Recommendations** For Linux kernel versions through 5.18.9, update to a version that includes the fix for the buffer overflow in `nft set elem init`. As a temporary workaround, consider restricting access to the `nft setelem parse data` function in `net/netfilter/nf tables api.c` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14.4 Security Update versions prior to 2019-002 High Sierra Security Update versions prior to 2019-002 Sierra **Description** A logic issue was addressed with improved validation. An attacker in a privileged network position can modify driver state. **Recommendations** For macOS versions prior to 10.14.4, update to macOS Mojave 10.14.4. For Security Update versions prior to 2019-002 High Sierra, apply Security Update 2019-002 High Sierra. For Security Update versions prior to 2019-002 Sierra, apply Security Update 2019-002 Sierra.

**Name of the Vulnerable Software and Affected Versions** Broadcom wl WiFi driver (affected versions not specified) **Description** The issue is related to a heap buffer overflow in the wlc wpa sup eapol function of the Broadcom wl WiFi driver. This can be triggered by supplying a vendor information element with a data length larger than 32 bytes. A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system or cause denial-of-service conditions by sending specially-crafted WiFi packets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Broadcom wl WiFi driver (affected versions not specified) **Description** The issue is related to a heap buffer overflow in the wlc wpa plumb gtk function of the Broadcom wl WiFi driver. This can be triggered by sending specially-crafted WiFi packets containing data larger than 164 bytes. A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Broadcom brcmfmac WiFi driver versions prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff **Description** The issue is related to a heap buffer overflow in the `brcmf wowl nd results` function. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can trigger this overflow. This can be exploited to compromise the host or, in combination with other vulnerabilities, can be used remotely. In the worst-case scenario, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system by sending specially-crafted WiFi packets. More typically, this issue will result in denial-of-service conditions. **Recommendations** For versions prior to commit 1b5e2423164b3670e8bc9170e8bc9174e4762d297990deff, consider disabling the Wake-up on Wireless LAN functionality to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** brcmfmac WiFi driver versions prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f **Description** The issue is related to insufficient input validation in the `is wlc event frame` function of the Broadcom brcmfmac WiFi driver. This can be exploited by a remote, unauthenticated attacker to bypass frame validation, potentially allowing the execution of arbitrary code on a vulnerable system or resulting in denial-of-service conditions. The vulnerability can be triggered by sending specially-crafted WiFi packets. **Recommendations** For versions prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f, consider updating to a version that includes the commit a4176ec356c73a46c07c181c6d04039fafa34a9f or later to resolve the issue. As a temporary workaround, consider restricting the use of USB WiFi dongles to minimize the risk of exploitation.