[security] Kr00k

[ThomasKaiser]

Since most if not all Armbian supported wireless capable boards use Broadcom/Cypress chipsets and the RPi 3 tested positive I guess all these devices are affected by Kr00k?

[EvilOlaf]

Hard to find any useful information around. Some threads popped up at Pihole and raspberry pi forums but nothing really yet.
https://nvd.nist.gov/vuln/detail/CVE-2019-15126
Seem to sit mainly in the bcm firmware which has to be patched by the manufacturer.
Maybe more affected chips will be named over time to be affected as well. For example the OPi Zero Plus H5 comes as per the data sheet with Realtek RTL8189FTV as WiFi.

[ThomasKaiser]

Hard to find any useful information around.

Huh? That we've heard about this publicly just yesterday is due to their rather responsible vulnerability disclosure policy. But the issue is well documented and the fact that the stuff here is rather outdated means at least the BCM equipped boards suffer from insecure wireless operation that is known to everyone since yesterday.

[ThomasKaiser]

Take this for example: Igor get's some files most probably from @hipboi and throws it in a repo where the giant armbian-firmware package is generated from. And from then on it's rotting forever there and on user's devices.

Broadcom fixed the stuff within the last months, they notified their 'customers' to provide this stuff as patches. So in an ideal world those vendors would now also fix their stuff (provide new firmware BLOBs) and push this out to users or 3rd parties like Armbian. But I guess the SBC world is not an ideal world...

[EvilOlaf]

...and probably never will.

I tried to find something even though I am not very deep into this topic. What I could find was The firmware-brcm80211 Debian package but this seem not to have received fixes yet. I also could not find (yet) any new upstream firmware blobs, maybe they are non-public? Would not make much sense though...

Xulong seem to have updated some firmware blobs last October. Not no idea which version these files have and what has been fixed :(
orangepi-xunlong/external@8cc49f4

[ThomasKaiser]

See also https://forum.armbian.com/topic/4949-security-broadpwn/ (Armbian and wireless security is essentially a non-issue since nobody gives a sh*t). Back then when I was really dumb and maintained some OMV ARM images I took care to replace the armbian-firmware package in favor of Raspbian's firmware-nonfree to fix this stuff at least on the most popular OMV for ARM image.

[EvilOlaf]

Sometimes you are on your own to make the world a bit better. This makes it not less valuable. In my eyes at least.

[EvilOlaf]

The Broadcom blobs in either the Xulong repo and the Debian package seem to be quite outdated. strings from each binary revealed dates from 2011 to 2018, nothing newer.

[igorpecovnik]

Can we fully ditch our firmware packages for upstream?https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git ...

Who will check that?

[EvilOlaf]

This would not fix the security flaw since those blobs seem to be quite old as well. The commit log confirms my results from strings:
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/log/brcm

[igorpecovnik]

This would not fix the security flaw since those blobs seem to be quite old as well.

So this will again require to provide better services as corporation supported upstream https://www.linuxfoundation.org

[AR-179]

[ThomasKaiser]

The Debian packages firmware-b43legacy-installer_019-4_all and firmware-b43-installer_019-4_all contain no actual data but do it this way via their postinst script:

The first one sucks random stuff from the Internet:

VERSION=""	
BROADCOM_WL=""	
WL_APSTA="wl_apsta-3.130.20.0.o"	
DOWNLOAD="${WL_APSTA}"	
URL="http://downloads.openwrt.org/sources/${WL_APSTA}"	
SHA512SUM="d89ed52045307449bbae79a4d1807cc6cd89ae67c4a22e8e8aa51c1396edbb6ed8b157cd0756faf8b660a537b48b62117c57967f2048245b5b102d9d9bca4bbd"	
FIRMWARE_INSTALL_DIR="/lib/firmware"	
B43="b43legacy"	

And the 2nd does the same:

VERSION="5.100.138"	
BROADCOM_WL="broadcom-wl-${VERSION}"	
WL_APSTA="${BROADCOM_WL}/linux/wl_apsta.o"	
DOWNLOAD="${BROADCOM_WL}.tar.bz2"	
URL="http://www.lwfinger.com/b43-firmware/${DOWNLOAD}"	
SHA512SUM="02487e76e3eca7fe97ce2ad7dc9c5d39fac82b8d5f7786cce047f9c85e2426f5b7ea085d84c7d4aae43e0fe348d603e3229211bab601726794ef633441d37a8b"	
FIRMWARE_INSTALL_DIR="/lib/firmware"	
B43="b43"	

[hipboi]

We already contacted Ampak for the new firmware. Will update here once we get the reply.

[ThomasKaiser]

Will update here once we get the reply.

Thank you Tom! Hope to hear from you soon.

@igorpecovnik in my opinion this flaw could serve as some sort of a testimonial which board makers do care about security and which don't. IMO it should be mentioned on the download page in a way such as 'Wi-Fi vulnerable to BroadPwn and Kr00k' (maybe even in big red letters) vs. 'Common Wi-Fi vulnerabilities like BroadPwn and Kr00k fixed'.

[EvilOlaf]

'Wi-Fi vulnerable to BroadPwn and Kr00k'...

...and there is no way for Armbian to fix this without the help of the chipset manufacturer, so please blame them.

😄