Skip to content

Commit 494bc10

Browse files
masrlinumasrlinu
committed
broadcom-wl: introduce common/broadcom-wifi.nix and import in Apple/Dell profiles
1 parent 8b5480f commit 494bc10

File tree

6 files changed

+42
-153
lines changed

6 files changed

+42
-153
lines changed

‎apple/imac/14-2/default.nix‎

Lines changed: 1 addition & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,9 @@
1111
../../../common/gpu/nvidia
1212
../../../common/gpu/nvidia/kepler
1313
../../../common/hidpi.nix
14+
../../../common/broadcom-wifi.nix
1415
];
1516

16-
options = {
17-
hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
18-
type = lib.types.bool;
19-
default = false;
20-
description = ''
21-
Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
22-
23-
This driver is vulnerable to heap buffer overflows:
24-
- CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
25-
- CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
26-
27-
Attackers within WiFi range can exploit this vulnerability by sending crafted
28-
WiFi packets, even without being connected to the same network. Simply having
29-
WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
30-
Only enable if no alternative WiFi solution is available.
31-
'';
32-
};
33-
};
34-
3517
config = {
3618
boot = {
3719
initrd.kernelModules = [
@@ -49,15 +31,6 @@
4931
"bcma"
5032
];
5133
kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
52-
extraModulePackages =
53-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
54-
[
55-
(config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
56-
meta = oldAttrs.meta // {
57-
knownVulnerabilities = [ ];
58-
};
59-
}))
60-
];
6134
};
6235

6336
hardware = {

‎apple/macbook-air/6/default.nix‎

Lines changed: 4 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,17 @@
11
{ config, lib, ... }:
22

33
{
4-
imports = [ ../. ];
5-
6-
options = {
7-
hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
8-
type = lib.types.bool;
9-
default = false;
10-
description = ''
11-
Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
12-
13-
This driver is vulnerable to heap buffer overflows:
14-
- CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
15-
- CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
16-
17-
Attackers within WiFi range can exploit this vulnerability by sending crafted
18-
WiFi packets, even without being connected to the same network. Simply having
19-
WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
20-
Only enable if no alternative WiFi solution is available.
21-
'';
22-
};
23-
};
4+
imports = [
5+
../.
6+
../../../common/broadcom-wifi.nix
7+
];
248

259
config = {
2610
boot = {
2711
# Divides power consumption by two.
2812
kernelParams = [ "acpi_osi=" ];
2913

3014
blacklistedKernelModules = [ "bcma" ];
31-
kernelModules = lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities [
32-
"wl"
33-
];
34-
extraModulePackages =
35-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
36-
[
37-
(config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
38-
meta = oldAttrs.meta // {
39-
knownVulnerabilities = [ ];
40-
};
41-
}))
42-
];
4315
};
4416

4517
services.xserver.deviceSection = lib.mkDefault ''

‎apple/macbook-pro/11-1/default.nix‎

Lines changed: 1 addition & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,40 +4,10 @@
44
../.
55
../../../common/pc/ssd
66
../../../common/cpu/intel/haswell
7+
../../../common/broadcom-wifi.nix
78
];
89

9-
options = {
10-
hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
11-
type = lib.types.bool;
12-
default = false;
13-
description = ''
14-
Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
15-
16-
This driver is vulnerable to heap buffer overflows:
17-
- CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
18-
- CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
19-
20-
Attackers within WiFi range can exploit this vulnerability by sending crafted
21-
WiFi packets, even without being connected to the same network. Simply having
22-
WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
23-
Only enable if no alternative WiFi solution is available.
24-
'';
25-
};
26-
};
27-
2810
config = {
2911
hardware.enableRedistributableFirmware = lib.mkDefault true; # broadcom-wl
30-
boot.kernelModules =
31-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
32-
[ "wl" ];
33-
boot.extraModulePackages =
34-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
35-
[
36-
(config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
37-
meta = oldAttrs.meta // {
38-
knownVulnerabilities = [ ];
39-
};
40-
}))
41-
];
4212
};
4313
}

‎common/broadcom-wifi.nix‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{ config, lib, pkgs, ... }:
2+
3+
{
4+
options = {
5+
hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
6+
type = lib.types.bool;
7+
default = false;
8+
description = ''
9+
Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
10+
11+
This driver is vulnerable to heap buffer overflows:
12+
- CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
13+
- CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
14+
15+
Attackers within WiFi range can exploit this vulnerability by sending crafted
16+
WiFi packets, even without being connected to the same network. Simply having
17+
WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
18+
Only enable if no alternative WiFi solution is available.
19+
'';
20+
};
21+
};
22+
23+
config = lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities {
24+
boot.kernelModules = [ "wl" ];
25+
boot.extraModulePackages = [
26+
(config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
27+
meta = oldAttrs.meta // {
28+
knownVulnerabilities = [ ];
29+
};
30+
}))
31+
];
32+
};
33+
}

‎dell/inspiron/3442/default.nix‎

Lines changed: 1 addition & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,10 @@
44
imports = [
55
../../../common/cpu/intel/haswell
66
../../../common/pc/laptop
7+
../../../common/broadcom-wifi.nix
78
];
89

9-
options = {
10-
hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
11-
type = lib.types.bool;
12-
default = false;
13-
description = ''
14-
Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
15-
16-
This driver is vulnerable to heap buffer overflows:
17-
- CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
18-
- CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
19-
20-
Attackers within WiFi range can exploit this vulnerability by sending crafted
21-
WiFi packets, even without being connected to the same network. Simply having
22-
WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
23-
Only enable if no alternative WiFi solution is available.
24-
'';
25-
};
26-
};
27-
2810
config = {
29-
boot.kernelModules =
30-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
31-
[ "wl" ];
32-
boot.extraModulePackages =
33-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
34-
[
35-
(config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
36-
meta = oldAttrs.meta // {
37-
knownVulnerabilities = [ ];
38-
};
39-
}))
40-
];
41-
4211
services = {
4312
fwupd.enable = lib.mkDefault true;
4413
thermald.enable = lib.mkDefault true;

‎dell/xps/13-9343/default.nix‎

Lines changed: 2 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -5,41 +5,13 @@
55
../../../common/cpu/intel
66
../../../common/pc/laptop
77
../../../common/pc/ssd
8+
../../../common/broadcom-wifi.nix
89
];
910

10-
options = {
11-
hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
12-
type = lib.types.bool;
13-
default = false;
14-
description = ''
15-
Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
16-
17-
This driver is vulnerable to heap buffer overflows:
18-
- CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
19-
- CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
20-
21-
Attackers within WiFi range can exploit this vulnerability by sending crafted
22-
WiFi packets, even without being connected to the same network. Simply having
23-
WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
24-
Only enable if no alternative WiFi solution is available.
25-
'';
26-
};
27-
};
28-
2911
config = {
3012
boot.kernelModules = [
3113
"kvm-intel"
32-
]
33-
++ lib.optionals config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities [ "wl" ];
34-
boot.extraModulePackages =
35-
lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities
36-
[
37-
(config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
38-
meta = oldAttrs.meta // {
39-
knownVulnerabilities = [ ];
40-
};
41-
}))
42-
];
14+
];
4315

4416
services = {
4517
fwupd.enable = lib.mkDefault true;

0 commit comments

Comments
 (0)