Switch Userland Flaws - Revision history

Hexkyz: Redirected page to Switch System Flaws

2022-11-10T17:16:32Z

← Older revision		Revision as of 20:16, 10 November 2022
Line 1:		Line 1:
	~~This page lists vulnerabilities / exploits for Nintendo Switch applications/applets and SDK.~~		#REDIRECT [[Switch_System_Flaws]]

	~~== Browser userspace ==~~
	~~{\| class="wikitable" border="1"~~
	~~! Summary~~
	~~! Description~~
	~~! Fixed with system version~~
	~~! Newest system version this flaw was checked for~~
	~~! Timeframe this was discovered~~
	~~! Discovered by~~
	\|-
	~~\| CVE-2016-4657~~
	\| WebKit vuln discovered around August 2016. Most notably used in the iOS 9.3.X exploit. A simple PoC can be found [https://github.com/LiveOverflow/lo_nintendoswitch/blob/master/poc1.html here]. This was later exploited by [https://twitter.com/qwertyoruiopz Qwertyoruiop] using an adjusted version of his iOS 9.3 webkit exploit (others exploited this prior to then).
	~~\| [[2.1.0]]~~
	~~\| [[2.0.0]]~~
	~~\| Original: August 2016~~
	~~Switch: March 3rd-4th 2017~~
	~~\| Everyone~~
	\|-
	~~\| CVE-2017-7005~~
	~~\| WebKit type confusion.~~
	~~\| [[3.0.1]]~~
	~~\| [[3.0.1]]~~
	\|
	~~\| Everyone~~
	\|-
	~~\| CVE-2016-4622~~
	~~\| WebKit memory corruption bug. This bug was incorrectly re-introduced in [[4.0.0]]. See [http://www.phrack.org/papers/attacking_javascript_engines.html here] for a detailed write-up from the author.~~
	~~\| [[6.1.0]]~~
	~~\| [[6.1.0]]~~
	\|
	~~\| Everyone~~
	\|-
	~~\| CVE-2018-4441~~
	~~\| WebKit memory corruption bug. See [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685&desc=2 here].~~
	~~\| [[7.0.0]]~~
	~~\| [[7.0.0]]~~
	\|
	~~\| Everyone~~
	\|}

	~~=== Whitelist ===~~
	This section documents [[Internet_Browser\|WebApplet]] whitelist issues in applications. These can be used to load your own browser content over plain HTTP, which then for example could be used for web-applet exploitation.

	~~{\| class="wikitable" border="1"~~
	~~! Application~~
	~~! Description~~
	~~! Fixed with app version~~
	~~! Newest app version this flaw was checked for~~
	~~! Timeframe this was discovered~~
	~~! Public disclosure timeframe~~
	~~! Discovered by~~
	\|-
	~~\| Sonic Mania~~
	\| Originally this game launched web-applet with a plain-http URL for displaying the manual, this was later changed to https. Originally the whitelist only had 1 entry for a http URL, this was later replaced with various https-only URLs.
	~~\| 1.04, unknown if fixed with an earlier update~~
	~~\| 1.04~~
	~~\| January (?) 2022~~
	~~\| February 23, 2022~~
	~~\| [[User:Yellows8\|yellows8]]~~
	\|}

	~~== NintendoSDK ==~~
	~~This section documents vulnerabilities for NSOs in NintendoSDK.~~

	~~=== nnSdk ===~~
	~~This section documents vulnerabilities for nnSdk (sdknso).~~

	~~{\| class="wikitable" border="1"~~
	\|-
	~~! Summary~~
	~~! Description~~
	~~! Successful exploitation result~~
	~~! Fixed in SDK [[System_Versions\|version]]~~
	~~! Last SDK version this flaw was checked for~~
	~~! Timeframe this was discovered~~
	~~! Public disclosure timeframe~~
	~~! Discovered by~~
	\|-
	~~\| [[Profile_Selector\|Profile Selector]] uninitialized input data~~
	~~\| Originally unused regions of [[Profile_Selector]] UiSettings/UserSelectionSettings were not cleared prior to being sent to the applet. With 1.x.x these are now properly memset().~~
	~~\| Stack infoleak from user-process, sent to the applet.~~
	~~\| 1.x.x~~
	~~\| 11.4.0~~
	~~\| November-December 2019~~
	~~\| December 31, 2020~~
	~~\| [[User:Yellows8\|yellows8]]~~
	\|-
	~~\| [[HID_services\|hidbus]] GetJoyPollingReceivedData buffer overflow~~
	\| hidbus GetJoyPollingReceivedData doesn't validate the u8 size used for memcpy, when copying the data to the output JoyPollingReceivedData. With 11.x, the size is now clamped to a maximum of 0x2C (regardless of polling-mode). Note that 0x2C is the data-size for JoyButtonOnlyPollingDataAccessor, the other polling-modes have a smaller size.

	The hid-sysmodule code which writes data here does handle it properly: size is clamped to a max size, and the data-read uses a fixed-size anyway (hence there's no way to trigger this sdknso vuln with the hid-sysmodule tmem writing code).

	~~This could only be exploited if one directly writes to the tmem when one has previously compromised hid-sysmodule, without using the normal tmem-writing func for this.~~

	~~There are only a few [[HID_services~~#~~ExternalDevices\|apps]] which use hidbus.~~
	~~\| Triggering a buffer overflow in an application which uses hidbus GetJoyPollingReceivedData, from a previously compromised hid-sysmodule.~~
	~~\| 11.x.0~~
	~~\| 11.4.0~~
	~~\| March 2020~~
	~~\| December 3, 2020~~
	\| [[~~User:Yellows8\|yellows8~~]]
	\|}

Yellows8: /* Browser userspace */

2022-02-23T20:20:03Z

Browser userspace

@@ Line 5: / Line 5: @@
 !  Summary
 !  Description
-!  Fixed with software update
+!  Fixed with system version
-!  Newest software update this flaw was checked for
+!  Newest system version this flaw was checked for
 !  Timeframe this was discovered
 !  Discovered by
@@ Line 38: / Line 38: @@
+|
 | Everyone
 |}

Yellows8: Reverted edits by Nigger (talk) to last revision by Yellows8

2021-10-06T22:05:03Z

Reverted edits by Nigger (talk) to last revision by Yellows8

Show changes

Nigger at 23:39, 6 October 2021

2021-10-06T21:39:32Z

Show changes

Yellows8: /* nnSdk */

2020-12-31T22:15:31Z

nnSdk

← Older revision		Revision as of 01:15, 1 January 2021
Line 56:		Line 56:
	! Public disclosure timeframe		! Public disclosure timeframe
	! Discovered by		! Discovered by
			\|-
			\| [[Profile_Selector\|Profile Selector]] uninitialized input data
			\| Originally unused regions of [[Profile_Selector]] UiSettings/UserSelectionSettings were not cleared prior to being sent to the applet. With 1.x.x these are now properly memset().
			\| Stack infoleak from user-process, sent to the applet.
			\| 1.x.x
			\| 11.4.0
			\| November-December 2019
			\| December 31, 2020
			\| [[User:Yellows8\|yellows8]]
	\|-		\|-
	\| [[HID_services\|hidbus]] GetJoyPollingReceivedData buffer overflow		\| [[HID_services\|hidbus]] GetJoyPollingReceivedData buffer overflow

Yellows8 at 21:56, 3 December 2020

2020-12-03T20:56:26Z

@@ Line 1: / Line 1: @@
-This page lists vulnerabilities / exploits for Nintendo Switch applications and applets.
+This page lists vulnerabilities / exploits for Nintendo Switch applications/applets and SDK.
 == Browser userspace ==
@@ Line 38: / Line 38: @@
+|
 | Everyone
 |}

Hexkyz: /* Browser userspace */

2019-03-10T19:25:13Z

Browser userspace

← Older revision		Revision as of 22:25, 10 March 2019
Line 29:		Line 29:
	\| [[6.1.0]]		\| [[6.1.0]]
	\| [[6.1.0]]		\| [[6.1.0]]
			\|
			\| Everyone
			\|-
			\| CVE-2018-4441
			\| WebKit memory corruption bug. See [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685&desc=2 here].
			\| [[7.0.0]]
			\| [[7.0.0]]
	\|		\|
	\| Everyone		\| Everyone
	\|}		\|}

Hexkyz: fckn RIP

2018-10-30T17:19:29Z

fckn RIP

← Older revision		Revision as of 20:19, 30 October 2018
Line 22:		Line 22:
	\| [[3.0.1]]		\| [[3.0.1]]
	\| [[3.0.1]]		\| [[3.0.1]]
			\|
			\| Everyone
			\|-
			\| CVE-2016-4622
			\| WebKit memory corruption bug. This bug was incorrectly re-introduced in [[4.0.0]]. See [http://www.phrack.org/papers/attacking_javascript_engines.html here] for a detailed write-up from the author.
			\| [[6.1.0]]
			\| [[6.1.0]]
	\|		\|
	\| Everyone		\| Everyone
	\|}		\|}

Hexkyz at 21:22, 29 April 2018

2018-04-29T19:22:14Z

← Older revision		Revision as of 23:22, 29 April 2018
Line 16:		Line 16:
	\| Original: August 2016		\| Original: August 2016
	Switch: March 3rd-4th 2017		Switch: March 3rd-4th 2017
	\| ~~???~~		\| Everyone
			\|-
			\| CVE-2017-7005
			\| WebKit type confusion.
			\| [[3.0.1]]
			\| [[3.0.1]]
			\|
			\| Everyone
	\|}		\|}

Yellows8 at 16:06, 15 April 2017

2017-04-15T14:06:49Z

← Older revision		Revision as of 18:06, 15 April 2017
Line 17:		Line 17:
	Switch: March 3rd-4th 2017		Switch: March 3rd-4th 2017
	\| ???		\| ???
	\|-
	~~\| [https://github.com/yellows8/browserhax_fright browserhax_fright_tx3g]~~
	\|
	~~\| [[2.1.0]]~~
	\|
	\|
	\|
	\|}		\|}