[3DS][StreetPass] Buffer Overflow in Super Mario Maker level decompression

Summary

--

#Information

• Platform: (New) Nintendo 3DS
• Region: EU (all regions are affected)
• System version: less or equal to 11.10 (latest)

#Description

Since the bootroms have been dumped, it is now possible for an attacker to decrypt streetpass communications. Super Mario Maker is vulnerable to a buffer overflow vulnerability when parsing received levels.

Vulnerability

When parsing a compressed level received via StreetPass, the application decompress each compressed chunk of the file. The size of the received file cannot exceed 0x18000 bytes but the size isn't checked so the application will try to parse past the end of the compressed buffer if a greater size is provided. Even though we cannot send more than 0x18000 bytes, the decompressed buffer is located just after the compressed buffer. Thus, one can craft a file where the first chunk is 0x18000 bytes long, the decompressed part is copied to compressed_buf+0x18000 and since the size isn't checked, the content at compressed_buf+0x18000 is parsed as the next compressed chunk and eventually copied past the end of the decompressed buffer. This makes it possible to overwrite objects on the heap and gain code execution.

Impact

This gives an attacker the ability to get userland remote code execution in Super Mario Maker.