Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Project Zero)
Here's a
lengthy and detailed description of how the Project Zero team reverse
engineered Broadcom's proprietary WiFi processor and developed a remote
code execution exploit. "All that said and done, the introduction of
Wi-Fi FullMAC chips does not come without a cost. Introducing these new
pieces of hardware, running proprietary and complex code bases, may weaken
the overall security of the devices and introduce vulnerabilities which
could compromise the entire system."