Heap Overflow in schreibfaul1 ESP32-audioI2S

Executive Summary

This is a heap-based buffer overflow in the ESP32-audioI2S library version 3.4.5. The vulnerability occurs in the HTTP request header construction logic, specifically in the Audio::connecttohost() function. Attacker-controlled input fields like host name, path, query string, and HTTP headers are concatenated into a fixed-size heap buffer without proper size checks. This allows an oversized crafted parameter to trigger out-of-bounds heap writes, potentially leading to arbitrary code execution or denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for unusually long HTTP request headers or URLs containing excessive parameters. Use tools like Wireshark to inspect HTTP headers for oversized host, path, or query strings. Check ESP32 device logs for crashes or watchdog timeouts during audio stream connections.

Useful 0 Not Useful 0

Impact Analysis

The primary impact is remote denial of service where the ESP32 device crashes due to a watchdog timeout, permanently disconnecting audio streams. Secondary risks include heap metadata corruption that could enable remote arbitrary code execution under specific memory conditions, as well as out-of-bounds memory reads that may leak sensitive device runtime and audio data.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the ESP32-audioI2S library version 3.4.5 if used in audio streaming applications. Implement input length validation for HTTP headers and URLs before processing. Use a network firewall to block malformed requests with excessively long parameters.

Useful 0 Not Useful 0