Hacker News Reader

I probably need to adapt the wording then.

Broadcom released an insufficient patch in 2018, then they moved to hostapd in their SDK. So as an OEM you can get the support of Broadcom to move to a fixed revision.

The whole issue is not that Broadcom has a bug, everyone has, it’s that their communication did not make its way down the supply chain.

They said they notified OEMs but refused to share the content with me. So we don’t know whether it was a single line in a changelog or an actual security advisory.

Since every OEM is not keeping track of all vendor communications, a proper CVE would have alerted the OEMs to take action 8 years ago I think.

View on HN

A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.

A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by a new version of their SDK which replaced the vulnerable components with hostapd. Broadcom recommended to move to this new SDK version, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.