search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Marvell Avastar wireless SoCs have multiple vulnerabilities

Vulnerability Note VU#730261

Original Release Date: 2019-02-05 | Last Revised: 2019-04-19

Overview

Some Marvell Avastar wireless system on chip (SoC) models have multiple vulnerabilities, including a block pool overflow during Wi-Fi network scan.

Description

A presentation at the ZeroNights 2018 conference describes multiple security issues with Marvell Avastar SoCs (models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997). The presentation provides some detail about a block pool memory overflow. During Wi-Fi network scans, an overflow condition can be triggered, overwriting certain block pool data structures. Because many devices conduct automatic background network scans, this vulnerability could be exploited regardless of whether the target is connected to a Wi-Fi network and without user interaction.

Impact

An unauthenticated attacker within Wi-Fi radio range may be able to use a specially-crafted series of Wi-Fi frames execute arbitrary code on a system with a vulnerable Marvell SoC. Depending on implementation, the compromised SoC may then be used to intercept network traffic or achieve code execution on the host system.

Solution

Marvell issued a statement and encourages customers to contact their Marvell representative for additional support. Microsoft issued an update to multiple Surface devices. See also the

Vendor Information section below.

Restrict physical access
An attacker needs to be within Wi-Fi radio range of the target to exploit the block pool overflow. Restricting access to the area around vulnerable devices may limit an attacker's ability to exploit this vulnerability.

Disable Wi-Fi
For systems that have other connectivity options like wired ethernet, it may be possible and practical to disable Wi-Fi.

Vendor Information

730261
 
Expand all

View all 212 vendors View less vendors


CVSS Metrics

Group Score Vector
Base 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C
Temporal 6.1 E:U/RL:OF/RC:C
Environmental 4.6 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Acknowledgements

This vulnerability was presented by Denis Selianin at the ZeroNights 2018 conference.

This document was written by Will Dormann and David Warren.

Other Information

CVE IDs: CVE-2019-6496
Date Public: 2018-11-21
Date First Published: 2019-02-05
Date Last Updated: 2019-04-19 17:53 UTC
Document Revision: 104

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis