[3DS][StreetPass] Heap Overflow in Swapnote parser leads to userland StreetPass RCE

Summary

#Affected Systems

• System: Nintendo 3DS
• Version: <= 11.13
• Region: ALL

#Description When parsing TLRF chunks in message files the application calls memcpy using user provided sizes to copy controlled data over a fixed-size buffer. Thus one can overflow heap chunks which is enough to get code execution (unsafe unlink). Since messages can be exchanged through StreetPass, one can get remote code execution in userland. For example these kinds of calls are made:

u32 offset_0 = *(u32*)(TLRF_buffer + 0x6DC);
u32 size_0 = *(u32*)(TLRF_buffer + 0x70C);
 memcpy(heap_buffer_0, TLRF_buffer + offset_0, size_0);
[...]
u32 offset_1 = *(u32*)(TLRF_buffer + 0x6EC);
u32 size_1 = *(u32*)(TLRF_buffer + 0x71C); 
memcpy(heap_buffer_1, TLRF_buffer + offset_1, size_1);

Impact

An attacker is able to get RCE in userland through the Swapnote application.