mirror of
https://github.com/NixOS/nixos-hardware.git
synced 2025-11-08 19:46:10 +01:00
Remove insecure broadcom-sta driver from hardware profiles
The broadcom-sta driver package is marked as insecure due to CVE-2019-9501 and CVE-2019-9502 (heap buffer overflow vulnerabilities allowing remote code execution). The driver is also unmaintained and incompatible with modern Linux kernel security mitigations. Removed broadcom_sta from extraModulePackages and the corresponding "wl" kernel module. This resolves test failures where Nixpkgs refuses to evaluate configurations containing this insecure package.
This commit is contained in:
parent
e214e292a6
commit
b09586b101
5 changed files with 0 additions and 16 deletions
|
|
@ -29,7 +29,6 @@
|
||||||
"bcma"
|
"bcma"
|
||||||
];
|
];
|
||||||
kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
|
kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
|
||||||
extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
hardware = {
|
hardware = {
|
||||||
|
|
|
||||||
|
|
@ -3,8 +3,6 @@
|
||||||
{
|
{
|
||||||
imports = [ ../. ];
|
imports = [ ../. ];
|
||||||
|
|
||||||
boot.kernelModules = [ "wl" ];
|
|
||||||
boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
|
|
||||||
boot.blacklistedKernelModules = [ "bcma" ];
|
boot.blacklistedKernelModules = [ "bcma" ];
|
||||||
|
|
||||||
boot = {
|
boot = {
|
||||||
|
|
|
||||||
|
|
@ -6,9 +6,5 @@
|
||||||
../../../common/cpu/intel/haswell
|
../../../common/cpu/intel/haswell
|
||||||
];
|
];
|
||||||
|
|
||||||
# broadcom-wl
|
|
||||||
hardware.enableRedistributableFirmware = lib.mkDefault true;
|
hardware.enableRedistributableFirmware = lib.mkDefault true;
|
||||||
# nixos-generate-config doesn't detect this automatically.
|
|
||||||
boot.extraModulePackages = with config.boot.kernelPackages; [ broadcom_sta ];
|
|
||||||
boot.kernelModules = [ "wl" ];
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -12,10 +12,4 @@
|
||||||
fwupd.enable = lib.mkDefault true;
|
fwupd.enable = lib.mkDefault true;
|
||||||
thermald.enable = lib.mkDefault true;
|
thermald.enable = lib.mkDefault true;
|
||||||
};
|
};
|
||||||
|
|
||||||
boot = {
|
|
||||||
# needs to be explicitly loaded or else bluetooth/wifi won't work.
|
|
||||||
kernelModules = [ "wl" ];
|
|
||||||
extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -13,11 +13,8 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
boot = {
|
boot = {
|
||||||
# needs to be explicitly loaded or else bluetooth/wifi won't work
|
|
||||||
kernelModules = [
|
kernelModules = [
|
||||||
"kvm-intel"
|
"kvm-intel"
|
||||||
"wl"
|
|
||||||
];
|
];
|
||||||
extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue