mirror of
				https://github.com/NixOS/nixos-hardware.git
				synced 2025-11-04 09:17:14 +08:00 
			
		
		
		
	Remove insecure broadcom-sta driver from hardware profiles
The broadcom-sta driver package is marked as insecure due to CVE-2019-9501 and CVE-2019-9502 (heap buffer overflow vulnerabilities allowing remote code execution). The driver is also unmaintained and incompatible with modern Linux kernel security mitigations. Removed broadcom_sta from extraModulePackages and the corresponding "wl" kernel module. This resolves test failures where Nixpkgs refuses to evaluate configurations containing this insecure package.
This commit is contained in:
		@@ -29,7 +29,6 @@
 | 
				
			|||||||
      "bcma"
 | 
					      "bcma"
 | 
				
			||||||
    ];
 | 
					    ];
 | 
				
			||||||
    kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
 | 
					    kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
 | 
				
			||||||
    extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
 | 
					 | 
				
			||||||
  };
 | 
					  };
 | 
				
			||||||
 | 
					
 | 
				
			||||||
  hardware = {
 | 
					  hardware = {
 | 
				
			||||||
 
 | 
				
			|||||||
@@ -3,8 +3,6 @@
 | 
				
			|||||||
{
 | 
					{
 | 
				
			||||||
  imports = [ ../. ];
 | 
					  imports = [ ../. ];
 | 
				
			||||||
 | 
					
 | 
				
			||||||
  boot.kernelModules = [ "wl" ];
 | 
					 | 
				
			||||||
  boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
 | 
					 | 
				
			||||||
  boot.blacklistedKernelModules = [ "bcma" ];
 | 
					  boot.blacklistedKernelModules = [ "bcma" ];
 | 
				
			||||||
 | 
					
 | 
				
			||||||
  boot = {
 | 
					  boot = {
 | 
				
			||||||
 
 | 
				
			|||||||
@@ -6,9 +6,5 @@
 | 
				
			|||||||
    ../../../common/cpu/intel/haswell
 | 
					    ../../../common/cpu/intel/haswell
 | 
				
			||||||
  ];
 | 
					  ];
 | 
				
			||||||
 | 
					
 | 
				
			||||||
  # broadcom-wl
 | 
					 | 
				
			||||||
  hardware.enableRedistributableFirmware = lib.mkDefault true;
 | 
					  hardware.enableRedistributableFirmware = lib.mkDefault true;
 | 
				
			||||||
  # nixos-generate-config doesn't detect this automatically.
 | 
					 | 
				
			||||||
  boot.extraModulePackages = with config.boot.kernelPackages; [ broadcom_sta ];
 | 
					 | 
				
			||||||
  boot.kernelModules = [ "wl" ];
 | 
					 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 
 | 
				
			|||||||
@@ -12,10 +12,4 @@
 | 
				
			|||||||
    fwupd.enable = lib.mkDefault true;
 | 
					    fwupd.enable = lib.mkDefault true;
 | 
				
			||||||
    thermald.enable = lib.mkDefault true;
 | 
					    thermald.enable = lib.mkDefault true;
 | 
				
			||||||
  };
 | 
					  };
 | 
				
			||||||
 | 
					 | 
				
			||||||
  boot = {
 | 
					 | 
				
			||||||
    # needs to be explicitly loaded or else bluetooth/wifi won't work.
 | 
					 | 
				
			||||||
    kernelModules = [ "wl" ];
 | 
					 | 
				
			||||||
    extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
 | 
					 | 
				
			||||||
  };
 | 
					 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 
 | 
				
			|||||||
@@ -13,11 +13,8 @@
 | 
				
			|||||||
  };
 | 
					  };
 | 
				
			||||||
 | 
					
 | 
				
			||||||
  boot = {
 | 
					  boot = {
 | 
				
			||||||
    # needs to be explicitly loaded or else bluetooth/wifi won't work
 | 
					 | 
				
			||||||
    kernelModules = [
 | 
					    kernelModules = [
 | 
				
			||||||
      "kvm-intel"
 | 
					      "kvm-intel"
 | 
				
			||||||
      "wl"
 | 
					 | 
				
			||||||
    ];
 | 
					    ];
 | 
				
			||||||
    extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
 | 
					 | 
				
			||||||
  };
 | 
					  };
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 
 | 
				
			|||||||
		Reference in New Issue
	
	Block a user