Switch System Flaws: Difference between revisions
No edit summary |
|||
Line 1,059: | Line 1,059: | ||
| December 14, 2021 | | December 14, 2021 | ||
| October 8, 2024 | | October 8, 2024 | ||
| [[User:Yellows8|yellows8]] | |||
|- | |||
| [[Audio_services|audren]] uncleared TransferMemory | |||
| audren OpenAudioRenderer uses the input tmem as workmem. The IAudioRenderer dtor doesn't clear the workmem properly. Depending on input params, certain objects stored here have vtables - hence infoleak. | |||
The exact location in the workmem will vary depending on the input params - these objects are dynamically allocated in the workmem. | |||
The following will leak vtables: Sink, Effect. | |||
If the initialization func fails, the tmem is unmapped without clearing it first. It's unknown whether there's a way to actually trigger an infoleak with this however. With [19.0.0+] it's now cleared on failure. | |||
With [19.0.0+] the dtor now clears the workmem when needed. | |||
| Reading leaked data/ptrs from TransferMemory -> defeating ASLR in [[Audio_services|audio]]-sysmodule. | |||
| [[19.0.0]] | |||
| [[19.0.0]] | |||
| December 17, 2022 | |||
| October 13, 2024 | |||
| [[User:Yellows8|yellows8]] | |||
|- | |||
| [[Audio_services|audren]] UpdateMixes OOB mem-copy | |||
| With nn::audio::server::InfoUpdater::UpdateMixes when nn::audio::server::BehaviorInfo::IsMixInParameterDirtyOnlyUpdateSupported() returns true (requires REV7, which is [7.0.0+]), the mix_id from user input is used without validation as input to <code><nn::audio::server::MixContext::GetInfo(int) const></code>, instead of the counter from the for-loop. This allows one to control the destination MixInfo index which the user-input data is written into. If too large, this will trigger OOB data-copy. Note that the u8 at dest_MixInfo+12 must be non-zero. | |||
Also note that a field is loaded from dest_MixInfo which is used as a splitter_id, so splitters need to be initialized where count is large enough for that id. | |||
With [19.0.0+] after getting the mix_id (loop-index/input) it now does: <code>if (mix_id < 0 || mix_id >= nn::audio::server::MixContext::GetCount()) continue;</code> | |||
| OOB mem-copy in [[Audio_services|audio]]-sysmodule, which for example can be used to overwrite a vtable used immediately after UpdateMixes. | |||
| [[19.0.0]] | |||
| [[19.0.0]] | |||
| December 19, 2022 | |||
| October 13, 2024 | |||
| [[User:Yellows8|yellows8]] | | [[User:Yellows8|yellows8]] | ||
|} | |} |