wireless

Reflected public keys: recovering the six digits of Bluetooth Passkey Entry

Bluetooth Passkey Entry spends a bit of the passkey per round so it can never be brute-forced offline. Reflect the initiator's public key back at it and it hands over one bit per round instead.

found by Tristan Claverie and José Lopes Esteves, ANSSI

Zero-click block pool overflow in Marvell Avastar Wi-Fi firmware (CVE-2019-6496)

A Wi-Fi SoC is a whole second computer with its own RTOS and its own RAM, and the firmware Denis Selianin fuzzed would parse hostile beacon frames on a five-minute timer with nobody in the loop.

found by Denis Selianin, Embedi