CVE-2022-3628

What it actually does

Buffer overflow in the Broadcom Full MAC Wi-Fi driver allows a local user with physical access to a malicious USB device to trigger memory corruption, resulting in system crash or privilege escalation.

Why it matters to the business

Linux systems using affected Broadcom Wi-Fi hardware face risk of denial of service or unauthorized root access when an attacker with physical access connects a crafted USB device; the issue has been public for over three years with public exploits available.

How an attack unfolds

An attacker with physical access crafts a malicious USB device that, upon connection, triggers the buffer overflow in the Broadcom driver during Wi-Fi initialization; the corruption can be leveraged to execute arbitrary code with elevated privileges or crash the kernel.

How to fix it

Update the Linux kernel to a version containing the fix for the Broadcom Full MAC Wi-Fi driver buffer overflow; if no fixed version is available for the distribution, disable the affected Broadcom driver or restrict physical USB access via policy and hardware controls.

How to confirm the fix worked

Confirm the installed kernel version contains the upstream fix for the Broadcom driver flaw; test by attempting connection with a benign USB device and verify no crash or unexpected behavior occurs under the affected driver.

Typical attack path

1. Obtain physical access to the target Linux system
2. Prepare and connect a malicious USB device designed to trigger the driver flaw
3. Trigger buffer overflow during device enumeration or Wi-Fi association
4. Exploit the resulting memory corruption for crash or privilege escalation

How to detect it

Review kernel logs for oops or panic messages related to the Broadcom Wi-Fi driver during USB device insertion events; examine audit logs for unexpected privilege changes or process spawns following USB activity on affected hardware.

What your security team should do

• Prioritize kernel updates on all systems with Broadcom Wi-Fi hardware
• Enforce physical security controls and USB device allow-listing where updates cannot be applied immediately
• Monitor for new kernel releases addressing this driver issue given the public exploit availability