Broadcom WPS Patch Reconstruction Exposes Potentially Exploitable Memory Corruption

An analysis of reconstructed Broadcom WPS source code indicates that a candidate 2018 patch left fragment-reassembly vulnerabilities incompletely fixed. A malformed follow-on fragment can trigger unsigned integer wraparound, bypass a length check, and pass a nearly 4 GB length to memcpy. While such a copy would ordinarily crash, certain 32-bit ARM glibc and µClibc/µClibc-ng implementations can turn it into bounded memory corruption that may enable further exploitation. Exposure must be assessed per firmware build, including BCM68xx and BCM65xx devices, by checking the selected C library, its patch status, and memory layout. The researcher recommends migrating to a Broadcom SDK version using hostapd, but cautions that the reconstructed history cannot establish exact affected SDK releases or official patch chronology.

Separate research into CVE-2023-28218 demonstrates how an oversized memory copy can become a practical exploitation primitive rather than merely cause a crash. In Windows’ afd.sys driver, an integer overflow during alignment of a user-controlled size enabled a kernel heap overflow, while a double-fetch condition allowed the size to change between allocation and copying. Researchers used controlled user memory and intentional page faults to constrain the copy, then manipulated kernel objects to bypass permission checks and escalate privileges. Microsoft addressed the flaw with safer integer-arithmetic functions. Together, the findings underscore the need to validate overflow handling and copy behavior against the actual runtime implementation; defenders should verify the Windows fix is deployed and assess Broadcom firmware individually rather than assuming the historical patch eliminated exposure.