CERT/CC Warns of Vulnerabilities in Marvell Avastar Wireless SoCs

February 08, 2019

The CERT Coordination Center (CERT/CC) has issued a vulnerability note providing information on a series of security issues impacting Marvell Avastar wireless system on chip (SoC) models.

Initially presented by Embedi security researcher Denis Selianin at the ZeroNights conference on November 21-22, 2018, and tracked as CVE-2019-6496(CVSS score 8.3), the vulnerability could allow an unauthenticated attacker within Wi-Fi radio range to execute code on a vulnerable system.

The security researcher discoveredmultiple vulnerabilities in the Marvell Avastar devices (models 88W8787, 88W8797, 88W8801, and 88W8897), the most important of which is a block pool overflow during Wi-Fi network scan.

The vulnerability can be exploited via malformed Wi-Fi packets during identification of available Wi-Fi networks.

"During Wi-Fi network scans, an overflow condition can be triggered, overwriting certain block pool data structures. Because many devices conduct automatic background network scans, this vulnerability could be exploited regardless of whether the target is connected to a Wi-Fi network and without user interaction," the CERT/CC vulnerability note reads.

Depending on the implementation, the attack could result in either network traffic interception or in achieving code execution on the host system.

Marvell has already acknowledged the issue and released a statement revealing that it has already deployed a fix in their standard driver and firmware.

"We have communicated to our direct customers to update to Marvell's latest firmware and driver to get the most recent security enhancements, including support for WPA3," Marvell said.

Given that the vulnerability requires the attacker to be within Wi-Fi radio range of the target, users can mitigate exploitation by restricting access to the area around vulnerable devices. Disabling Wi-Fi on systems that have other connectivity options should also prevent the attack, CERT/CC says.

"Marvell is not aware of any real world exploitation of this vulnerability outside of a controlled environment," Marvell noted, encouraging customers to contact their Marvell representative for additional support.

The United States Computer Emergency Team too encouragesusers and administrators to review CERT/CC's Vulnerability Note and refer to vendors for appropriate updates.