CVE-2017-0561

This exploit targets a heap overflow vulnerability in Broadcom Wi-Fi SoCs (CVE-2017-0561) by crafting malicious TDLS Teardown Request frames. The overflow occurs due to unchecked length fields in Fast Transition IE, leading to arbitrary code execution on vulnerable devices.

This exploit targets a heap overflow vulnerability in Broadcom Wi-Fi SoCs (CVE-2017-0561) by sending a malformed TDLS Setup Confirm frame with an abnormally large RSN IE, leading to a heap buffer overflow in the 'wlc_tdls_cal_mic_chk' function. The PoC includes a patch for wpa_supplicant 2.6 to trigger the vulnerability, causing a denial-of-service (DoS) on affected devices.