Apple fixes wireless-based remote code execution flaw in iOS

Apple released an iOS update Monday to fix a serious vulnerability that could allow attackers to remotely execute malicious code on the Broadcom Wi-Fi chips used in iPhones, iPads, and iPods.

The vulnerability is a stack buffer overflow in the feature that handles authentication responses for the fast BSS transition feature of the 802.11r protocol, also known as fast roaming. This feature allows devices to move easily and securely between different wireless base stations in the same domain.

Hackers can exploit the flaw to execute code in the context of the Wi-Fi chip’s firmware if they’re within the wireless range of the targeted devices.

The issue is one of several flaws found by Google Project Zero researcher Gal Beniamini in the firmware of Broadcom Wi-Fi chips. Some of these vulnerabilities also affect Android devices and have been patched as part of Android’s April security bulletin.

The iOS 10.3.1 update released Monday is a bit unusual because it only fixes this one flaw and comes just one week after Apple released iOS 10.3, a larger update that patched a wide range of vulnerabilities in various components.

The explanation for the short time interval between these two releases might come from Google Project Zero’s timeline for this flaw. According to an entry on its bug tracker, the team reported the vulnerability to Broadcom in December.

The chip vendor later requested an extension to Google’s standard 90-day disclosure deadline and was given a grace period until April 1. Because the flaw was in Broadcom’s code, not Apple’s, the iPhone maker had to wait for a patch from the chip vendor before testing it and pushing it out to its own user base.

The iOS 10.3.1 update is available for the iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation and later. Even if there is no public exploit yet, users are advised to install the update as soon as possible.