File tree Expand file tree Collapse file tree 5 files changed +68
-59
lines changed
Expand file tree Collapse file tree 5 files changed +68
-59
lines changed Original file line number Diff line number Diff line change 1919 default = true ;
2020 description = ''
2121 Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
22-
22+
2323 This driver is vulnerable to heap buffer overflows:
2424 - CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
2525 - CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
26-
26+
2727 Attackers within WiFi range can exploit this vulnerability by sending crafted
2828 WiFi packets, even without being connected to the same network. Simply having
2929 WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
5151 kernelPackages = lib . mkIf ( lib . versionOlder pkgs . linux . version "6.0" ) pkgs . linuxPackages_latest ;
5252 } ;
5353
54- extraModulePackages = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [
55- ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
56- meta =
57- oldAttrs . meta
58- // {
59- knownVulnerabilities = [ ] ;
60- } ;
61- } ) )
62- ] ;
54+ extraModulePackages =
55+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
56+ [
57+ ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
58+ meta = oldAttrs . meta // {
59+ knownVulnerabilities = [ ] ;
60+ } ;
61+ } ) )
62+ ] ;
6363
6464 hardware = {
6565 bluetooth . enable = lib . mkDefault true ;
Original file line number Diff line number Diff line change 99 default = true ;
1010 description = ''
1111 Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
12-
12+
1313 This driver is vulnerable to heap buffer overflows:
1414 - CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
1515 - CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
16-
16+
1717 Attackers within WiFi range can exploit this vulnerability by sending crafted
1818 WiFi packets, even without being connected to the same network. Simply having
1919 WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
2424
2525 config = {
2626 boot = {
27- # Divides power consumption by two.
27+ # Divides power consumption by two.
2828 kernelParams = [ "acpi_osi=" ] ;
2929
3030 blacklistedKernelModules = [ "bcma" ] ;
31- kernelModules = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [ "wl" ] ;
32- extraModulePackages = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [
33- ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
34- meta =
35- oldAttrs . meta
36- // {
37- knownVulnerabilities = [ ] ;
38- } ;
39- } ) )
31+ kernelModules = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [
32+ "wl"
4033 ] ;
34+ extraModulePackages =
35+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
36+ [
37+ ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
38+ meta = oldAttrs . meta // {
39+ knownVulnerabilities = [ ] ;
40+ } ;
41+ } ) )
42+ ] ;
4143 } ;
4244
4345 services . xserver . deviceSection = lib . mkDefault ''
Original file line number Diff line number Diff line change 1212 default = true ;
1313 description = ''
1414 Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
15-
15+
1616 This driver is vulnerable to heap buffer overflows:
1717 - CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
1818 - CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
19-
19+
2020 Attackers within WiFi range can exploit this vulnerability by sending crafted
2121 WiFi packets, even without being connected to the same network. Simply having
2222 WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
2727
2828 config = {
2929 hardware . enableRedistributableFirmware = lib . mkDefault true ; # broadcom-wl
30- boot . kernelModules = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [ "wl" ] ;
31- boot . extraModulePackages = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [
32- ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
33- meta =
34- oldAttrs . meta
35- // {
36- knownVulnerabilities = [ ] ;
37- } ;
38- } ) )
39- ] ;
30+ boot . kernelModules =
31+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
32+ [ "wl" ] ;
33+ boot . extraModulePackages =
34+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
35+ [
36+ ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
37+ meta = oldAttrs . meta // {
38+ knownVulnerabilities = [ ] ;
39+ } ;
40+ } ) )
41+ ] ;
4042 } ;
4143}
Original file line number Diff line number Diff line change 1212 default = true ;
1313 description = ''
1414 Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
15-
15+
1616 This driver is vulnerable to heap buffer overflows:
1717 - CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
1818 - CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
19-
19+
2020 Attackers within WiFi range can exploit this vulnerability by sending crafted
2121 WiFi packets, even without being connected to the same network. Simply having
2222 WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
2626 } ;
2727
2828 config = {
29- boot . kernelModules = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [ "wl" ] ;
30- boot . extraModulePackages = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [
31- ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
32- meta =
33- oldAttrs . meta
34- // {
35- knownVulnerabilities = [ ] ;
36- } ;
37- } ) )
38- ] ;
29+ boot . kernelModules =
30+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
31+ [ "wl" ] ;
32+ boot . extraModulePackages =
33+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
34+ [
35+ ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
36+ meta = oldAttrs . meta // {
37+ knownVulnerabilities = [ ] ;
38+ } ;
39+ } ) )
40+ ] ;
3941
4042 services = {
4143 fwupd . enable = lib . mkDefault true ;
Original file line number Diff line number Diff line change 1313 default = true ;
1414 description = ''
1515 Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
16-
16+
1717 This driver is vulnerable to heap buffer overflows:
1818 - CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
1919 - CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
20-
20+
2121 Attackers within WiFi range can exploit this vulnerability by sending crafted
2222 WiFi packets, even without being connected to the same network. Simply having
2323 WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
2727 } ;
2828
2929 config = {
30- boot . kernelModules = [ "kvm-intel" ] ++ lib . optionals config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [ "wl" ] ;
31- boot . extraModulePackages = lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [
32- ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
33- meta =
34- oldAttrs . meta
35- // {
36- knownVulnerabilities = [ ] ;
37- } ;
38- } ) )
39- ] ;
30+ boot . kernelModules = [
31+ "kvm-intel"
32+ ]
33+ ++ lib . optionals config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities [ "wl" ] ;
34+ boot . extraModulePackages =
35+ lib . mkIf config . hardware . broadcom . wifi . enableLegacyDriverWithKnownVulnerabilities
36+ [
37+ ( config . boot . kernelPackages . broadcom_sta . overrideAttrs ( oldAttrs : {
38+ meta = oldAttrs . meta // {
39+ knownVulnerabilities = [ ] ;
40+ } ;
41+ } ) )
42+ ] ;
4043
4144 services = {
4245 fwupd . enable = lib . mkDefault true ;
You can’t perform that action at this time.
0 commit comments