Modern, complicated PCIe device run large firmware that can, [and has](https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html), been found to contain vulnerabilities that allow remote exploitation. A vulnerability on the card could allow a remote attacker to gain complete arbitrary code execution on the card and modify the behavior of its firmware. So let's assume that an attacker has found a vulnerability in your WWAN card and has successfully gained code execution privileges on the card itself. What can they do with this?

##DMA attacks

When a PCIe device is present, the operating system will configure it and will usually set the [bus master enable bit](https://wiki.osdev.org/PCI#PCI_Device_Structure), a feature that allows it to perform arbitrary DMA requests (reads and writes to any memory location). Operating systems do have a way to prevent this when a modern processor is used. A processor's IOMMU is capable of filtering out DMA requests to unusual locations. When an IOMMU is properly supported and enabled, the operating system kernel will set up a small quarantine area where DMA is allowed. The PCIe device and the kernel communicate by passing data in that dedicated region. If the device attempts to write anywhere else, the IOMMU will block it.

##Kernel exploits

If an IOMMU is present and enabled, the device and kernel will only be able to communicate using a dedicated region of memory where DMA writes and reads are permitted. The device will pass data structures to the kernel and will then tell the kernel to process the data by issuing an [interrupt](https://en.wikipedia.org/wiki/Interrupt) or the related [MSI](https://en.wikipedia.org/wiki/Message_Signaled_Interrupts). When this signal is raised, the kernel will call an _interrupt handler_ to process the data at the designated DMA buffer. With this comes the risk that this processing stage itself is buggy. Code in the kernel runs at ring 0, the most privileged protection ring, so [any vulnerability in its code](https://security.stackexchange.com/q/176503/165253) can be disastrous. In the case where a vulnerability can be triggered by placing malicious data in the DMA buffer and raising an interrupt, then even an IOMMU will not be able to protect you.

##Network abuse

A WWAN device is naturally going to behave as your NIC, receiving and sending packets to the network. An oft-overlooked problem with a vulnerable NIC is the fact that any attacker that has compromised it will now be in a privileged position on the network. They will be able to modify any incoming or outgoing packets at will and can perform man-in-the-middle attacks easily. A simple attack vector would be to replace a downloaded update or executable with a malicious version. Even without privileged access to memory, a compromised NIC can do a lot of damage.