Switch System Flaws - Revision history

Yellows8: /* System Modules */

2026-03-17T05:04:37Z

System Modules

← Older revision		Revision as of 08:04, 17 March 2026
Line 1,189:		Line 1,189:

	[22.0.0+] This was fixed by clamping the count to a maximum of 0x4.		[22.0.0+] This was fixed by clamping the count to a maximum of 0x4.
	\| OOB datacopy into object state. Allows leaking arbitary handles, including on [S2] (such as process-handle, sm, ~~[[SPL_services\|spl:mig]]~~).		\| OOB datacopy into object state. Allows leaking arbitary [[NFC_services\|handles]], including on [S2] (such as process-handle, sm, fsp-srv (remaining services can also be used via sm)).
	\| [[22.0.0]]		\| [[22.0.0]]
	\| [[22.0.0]]		\| [[22.0.0]]

2026-03-17T04:31:39Z

System Modules

@@ Line 1,180: / Line 1,180: @@
 | November 2021?
 | January 19, 2026
 | [[User:Yellows8|yellows8]]
 |}

2026-02-19T23:30:59Z

Flesh out detail on Splatoon 3 report based on HackerOne summary.

← Older revision		Revision as of 02:30, 20 February 2026
Line 1,542:		Line 1,542:
	\|-		\|-
	\| Splatoon 3		\| Splatoon 3
	\| ~~Predictable~~ seed ~~in anti-cheat system?~~		\| Anticheat Seed Randomization Weakness
	\| [https://hackerone.com/reports/3042475 HackerOne report]		\| This oversight of seed generation would allow an attacker to quickly compute all code hashes, and modify game code, while still producing a valid ch1 hash.
	\| ~~Relatively easy way~~ to bypass anti-cheat.
	\| ?		[https://hackerone.com/reports/3042475 HackerOne report]
	\| ~~Reported on~~ March 17, 2025		\| Allows an attacker to bypass the ch1 anti-cheat hashing mechanism.
			\| 10.0.0
			\| March 17, 2025
	\| February 19, 2026		\| February 19, 2026
	\| hana2736		\| hana2736
	\|}		\|}

2026-02-19T16:12:22Z

Games

← Older revision		Revision as of 19:12, 19 February 2026
Line 1,533:		Line 1,533:

	[https://hackerone.com/reports/3463719 HackerOne report]		[https://hackerone.com/reports/3463719 HackerOne report]

			This stack infoleak was also present in the [[LDN_services\|ldn]] AdvertiseData.
	\| A memory address can leaked (this is a requirement for many types of attacks).		\| A memory address can leaked (this is a requirement for many types of attacks).
	\| 1.5.0		\| 1.5.0
	\| December 12, 2025		\| December 12, 2025
	\| February 19, 2026		\| February 19, 2026
	\| [https://github.com/kinnay Yannik]		\| [https://github.com/kinnay Yannik], yellows8 (ldn)
	\|-		\|-
	\| Splatoon 3		\| Splatoon 3

2026-02-19T14:06:30Z

← Older revision		Revision as of 17:06, 19 February 2026
Line 1,528:		Line 1,528:
	\| Mario Kart World		\| Mario Kart World
	\| ASLR leak in application data		\| ASLR leak in application data
	\| A memory address can be leaked by changing your username to something short, and hosting a network session in LAN mode (press L + R + Left Stick on the main menu to enable this). The memory address can be found in bytes 12 - 19 of the application data that is transmitted ~~after receiving~~ a browse request.		\| A memory address can be leaked by changing your username to something short, and hosting a network session in LAN mode (press L + R + Left Stick on the main menu to enable this). The memory address can be found in bytes 12 - 19 of the application data that is transmitted in response to a browse request.

	'''Note:''' there is more uninitialized data in the packet, but the memory address is probably the most interesting part. The vulnerability was fixed by clearing the application data with zeros, before filling in the information.		'''Note:''' there is more uninitialized data in the packet, but the memory address is probably the most interesting part. The vulnerability was fixed by clearing the application data with zeros, before filling in the information.

2026-02-19T14:04:43Z

Add information about ASLR leak in Mario Kart World, and a publicly disclosed Splatoon 3 report

@@ Line 1,124: / Line 1,124: @@
 | June 6, 2025
 | August 8, 2025
-| Yannik
+| [https://github.com/kinnay Yannik]
 |-
 | [[LDN_services|ldn]] AdvertiseData OOB-memcpy with EncryptionType3 (AES-128-GCM) actionframes (ldnhax)
@@ Line 1,328: / Line 1,328: @@
 | December, 2022
 | May, 2024
-| Yannik
+| [https://github.com/kinnay Yannik]
 |}
@@ Line 1,509: / Line 1,509: @@
 | Early April 2022
 | November 16, 2022
-| [[User:Rambo6Glaz|Rambo6Glaz]], Yannik (massive RE help)
+| [[User:Rambo6Glaz|Rambo6Glaz]], [https://github.com/kinnay Yannik] (massive RE help)
 |}
 There's another one more interesting but it will have to wait a bit :)

2026-01-20T04:59:26Z

System Modules

@@ Line 1,167: / Line 1,167: @@
 | November 2021?
 | November 26, 2025
 | [[User:Yellows8|yellows8]]
 |}

2025-12-13T17:20:06Z

@@ Line 1,116: / Line 1,116: @@
 | May 4, 2025
 | [[User:Yellows8|yellows8]]
 |-
 | [[LDN_services|ldn]] AdvertiseData OOB-memcpy with EncryptionType3 (AES-128-GCM) actionframes (ldnhax)
@@ Line 1,285: / Line 1,294: @@
 | December 31, 2020
 | [[User:Yellows8|yellows8]]
 |}
@@ Line 1,465: / Line 1,496: @@
 | Early April 2022
 | November 16, 2022
-| [[User:Rambo6Glaz|Rambo6Glaz]], Kinnay (massive RE help)
+| [[User:Rambo6Glaz|Rambo6Glaz]], Yannik (massive RE help)
 |}
 There's another one more interesting but it will have to wait a bit :)

2025-11-27T04:38:41Z

System Modules

@@ Line 1,145: / Line 1,145: @@
 | June 3, 2024 (possibly eariler(?))
 | November 14, 2025
 | [[User:Yellows8|yellows8]]
 |}

2025-11-14T23:03:08Z

System Modules

← Older revision		Revision as of 02:03, 15 November 2025
Line 1,140:		Line 1,140:

	[21.0.0+] Arrayindex=0 is now used when the input is invalid.		[21.0.0+] Arrayindex=0 is now used when the input is invalid.
	\|		\| Likely useless, even if reachable?
	\| [[21.0.0]]		\| [[21.0.0]]
	\| [[21.0.0]]		\| [[21.0.0]]