Description
A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the context of the Wi-Fi SoC. This issue is rated as Critical due to the possibility of remote code execution in the context of the Wi-Fi SoC. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34199105. References: B-RB#110814.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Android | Kernel-3.10, Kernel-3.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firmware-nonfree | 20180518-1 | — |
| Debian 13 | firmware-nonfree | 20180518-1 | — |
| Debian 12 | firmware-nonfree | 20180518-1 | — |
| Debian 8 | firmware-nonfree | 20161130-4~deb8u1 | DLA-1573-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Broadcom Wi-Fi SoC - TDLS Teardown Request Remote Heap Overflow EDB-41805 · remote · Apr 4, 2017 · verified
- Broadcom Wi-Fi SoC - Heap Overflow 'wlc_tdls_cal_mic_chk' Due to Large RSN IE in TDLS Setup Confirm Frame EDB-41806 · dos · Apr 4, 2017 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DLA-1573-1 firmware-nonfree - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 97367 vdb-entry
- https://source.android.com/security/bulletin/2017-04-01
- 41805 exploit
- [debian-lts-announce] 20181113 [SECURITY] [DLA 1573-1] firmware-nonfree security update mailing-list
- 41806 exploit
- 1038201 vdb-entry