Researcher discovers zeroclick-rce flaw in commonly used firmware for WiFi chips

A security researcher has found an rce vulnerability in the ThreadX firmware, which the developer says is used in more than six billion devices, including the Wi-Fi chips of the Surface, Galaxy J1, Steam Link, PS4 and Xbox One. A fix is ​​on the way.

Because the fix has not yet been published, researcher Denis Selianin does not give away the exploit code itself in his report. He did, however, release a proof of concept for the Steam Link. This concerns a total of four vulnerabilities, the largest of which is extensively treated. Devices using the operating system in question scan the environment for Wi-Fi signals every five minutes, whether they are already connected or not. This offers the opportunity to achieve a stack-based buffer overflow by means of a false WiFi signal.

In the proof of concept, the final result is some messages in the kernel log, but this exploit makes it possible to execute self-written code, which offers far-reaching possibilities. The exploit requires no action from the user, other than turning on the device. The attacker must be physically within the target’s Wi-Fi range to perform the exploit.

The researcher has focused on the Marvell Avastar 88W8897 WiFi chip, as it uses the operating system in question and is included in the popular devices mentioned above. ZDNet writes that the maker of the operating system is working on an update to fix the vulnerabilities.