Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

embedi.org

Post reply on HN
Print view View original

1–10 of 51 posts

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#2

Post by PappaPatat »

TL;DR Reseacher finds super cool RCE over (unconnected) WiFi for the Marvell Avastar Wi-Fi chipset family firmware and one to (locally) exploit the AP device driver.

List of impacted devices includes PS4, Xbox One, Samsung Chromebooks, and Microsoft Surface devices.

Nicely written paper from Embedi researcher Denis Selianin himself:

https://embedi.org/blog/remotely-compromise-devices-by-using...

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#3

Post by devereaux »

Given that Wifi chips already have their own ARM CPU, at this point I'd rather have that CPU which already runs its own OS to just present as a network device to do NAT. Connect it to the fixed network, use a serial link - anything will do.

At least, I'd rather have anything but the current alternative: a device on the PCI bus having DMA with a firmware I can't audit.

Same thing with WWAN device by the way.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#7

Post by jake_the_third »

Good. I hope that vulnerabilities like this continue to surface until legislators take notice. Morally bankrupt vendors will never stop locking down hardware unless governments get involved. Fuck each and every company that does this. Fuck them all to hell.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#8

Post by hawski »

mehrdadn wrote: post #5

I'm confused.. so Wi-Fi chips run OSes inside them now?

Remember that your computer is really made of multiple computers that run bare-metal code or can have their own OSes. For example Intel CPUs have Minix running inside of them.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#9

Post by minipci1321 »

devereaux wrote: post #3

Given that Wifi chips already have their own ARM CPU, at this point I'd rather have that CPU which already runs its own OS to just present as a network device to do NAT. Connect it to the fixed network, use a serial link - anything will do. At least, I'd rather have anything but the current alternative: a device on the PCI bus having DMA with a firmware I can't audit. Same thing with WWAN device by the way.

Not speaking specifically of the OP case, but CPU gets less and less involved in the datapath starting from a certain requirement of the max throughput. Insisting on it's going through the CPU still would raise the bar on the CPU (as a consequence, more fast RAM and increased overall power consumption, shorter battery life).

> with a firmware I can't audit.

In modern fast datapaths, there is a good deal of hardware acceleration involved, the firmware code would probably be incomprehensible without intimately knowing these.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#10

Post by mehrdadn »

hawski wrote: post #8
mehrdadn wrote: post #5

I'm confused.. so Wi-Fi chips run OSes inside them now?

Remember that your computer is really made of multiple computers that run bare-metal code or can have their own OSes. For example Intel CPUs have Minix running inside of them.

Some of these I knew (hard drive, LTE modem, etc.), but I didn't realize Wi-Fi was such an example.
Post reply on HN