[lxgr]

Since the bug is apparently in FullMAC devices, it would be a firmware fix in most cases (unless someone is running a FullMAC device as SoftMAC for whatever reason).

Also, the boundaries between firmware, hardware and (driver) software are pretty murky as far as Wi-Fi drivers are concerned: I remember reading that many FullMAC devices contain their own firmware in a ROM and have some room in on-chip RAM for patches (but not an entirely new firmware image!). These patches can be uploaded at device initialisation time and are contained in the device driver.

This is similar conceptually to microcode, both in that such updates are not persistent (i.e. have to be applied again after every boot) and optional (compared to a mandatory firmware blob upload, you won't notice if your driver is outdated or simply not installing updates for a known vulnerability).

[heavyset_go]

Thanks for your detailed post.

> Also, the boundaries between firmware, hardware and (driver) software are pretty murky as far as Wi-Fi drivers are concerned

Yeah, this is why I ask if it can be fixed via software. I've been utterly surprised at the amount of bugs that exist in firmware but can be mitigated on the seemingly software-side of things.

I have a device that used the brcmfmac driver on Linux until today, and am hoping I won't have to shelve it forever.

[jascii]

> I have a device that used the brcmfmac driver on Linux until today, and am hoping I won't have to shelve it forever.

No need to shelve the device, just don't treat WiFi as a "trusted zone" and use better encryption on top of WPA2. You should anyway, and this vulnerability is just another small reason why. What this vulnerability does -- as I understand it -- is, when a device dissociates with the network, send the rest of the tx buffer with a zero'd out encryption key. And thus leaks a small amount of data. Not good, however if you apply common best practices to your network I wouldn't lose any sleep over it.

[rasz]

https://www.youtube.com/watch?v=4_nI9ok7iQg broadcom BT chip has limited number of patch slots, and apparently even in the newest shipping iphones they are all fully taken with bugfixes. Since BT and Wifi live on the same chip I wonder if those slots are shared.