Ghost in the Wireless, iwlwifi Edition

Overview: A security researcher presents an in-depth reverse engineering and vulnerability analysis of Intel Wi-Fi chipsets and the Linux iwlwifi driver subsystem. Motivated by an unexplained hardware crash observed when transmitting files over HTTP from a smartphone to a laptop, the research explores the undocumented architecture of ubiquitous Intel wireless chips. The speaker details the reverse engineering of proprietary signed firmware, the discovery of a critical stack buffer overflow in the Upper MAC processor, and the bypass of production hardware protections to gain arbitrary code execution and enable debug mode.

Key Topics: - Architecture of Intel Wi-Fi hardware (UMAC and LMAC dual-CPU design) - Reverse engineering signed firmware binaries and ARC Compact instruction sets - Exploiting debugfs memory inspection interfaces in production chips - Stack buffer overflow exploitation in the uCode command handler and hardware debug enablement

Technical Details: Intel Wi-Fi chipsets feature a multi-processor architecture operating as a PCI Express (PCIe) device. The hardware incorporates two distinct processors executing from shared on-chip memory: the Upper MAC (UMAC) CPU, responsible for high-level 802.11 protocol handling, and the Lower MAC (LMAC) CPU, which interfaces directly with the physical radio hardware. During system initialization, the Linux iwlwifi kernel module transmits signed firmware binaries structured as Type-Length-Value (TLV) entries over PCIe into the chip's internal SRAM. Because the firmware is cryptographically signed by Intel, direct firmware modification triggers secure boot faults within the wireless controller.

By analyzing iwlwifi kernel source headers, the researcher developed custom Python decoders to unpack firmware metadata and separate code sections assigned to the UMAC and LMAC processors. Using the cpu_rec identification tool, the researcher identified the processor architecture as ARC Compact, subsequently writing a custom decompiler module for IDA Pro and submitting an ARC Compact implementation to the Ghidra project (PR #3006). Further investigation of the Linux debugfs interface revealed unexpected exposure in production chips: the /sys/kernel/debug/iwlwifi/.../mem and prph interfaces allowed arbitrary reading of on-chip memory and memory-mapped peripheral registers via PCIe, including real-time program counter (PC) registers (UMAC_PRPH_PC and LMAC_PRPH_PC).

Analyzing the UMAC command handler in IDA Pro revealed an exploitable stack buffer overflow vulnerability. The function umac_cmd_handler parsed incoming command packets by accepting a 32-bit integer length parameter directly from the input payload and copying bytes into a stack-allocated buffer without bounds verification or stack canary protections. To reliably exploit the flaw without rebuilding kernel drivers, the researcher used Linux kernel function hooking (via ftrace/eBPF) to inject payloads into Read-Write-Execute (RWX) memory sections and overwrite the saved return address. The arbitrary code execution payload altered internal control registers (setting bit 0x400) to permanently unlock production hardware into debug mode, granting unrestricted read/write access over the entire chip memory space.

Key Takeaways: Hardware and firmware vendors must implement strict bounds verification and stack canary protections within embedded microcontroller firmware parsing external host commands. Production hardware must permanently disable or cryptographically restrict diagnostic PCIe and debugfs interfaces that allow unprivileged or ring-0 reading of on-chip registers and SRAM. Kernel drivers should restrict low-level device memory read access to prevent attackers from mapping execution flows and bypassing firmware signing boundaries.

(AI summary — Gemini Flash)