Heap-based Buffer Overflow in ESP32-audioI2S

Executive Summary

This is a heap-based buffer overflow in the ESP32-audioI2S library version 3.4.5. The vulnerability exists in the htmlToUTF8() function which processes HTML entity strings from metadata or network streams. The function uses unsafe memmove and memcpy operations without checking buffer sizes, allowing attackers to send oversized HTML entities that overflow the heap buffer. This can lead to remote code execution, memory leaks, crashes, or privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or reboots in ESP32 devices running schreibfaul1 ESP32-audioI2S 3.4.5 when processing HTML entity strings. Use AddressSanitizer or similar tools to log heap-buffer-overflow errors during audio stream metadata parsing. Check for repeated crashes during remote audio playback or stream label processing.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause remote denial of service by crashing the ESP32 device, requiring a manual power cycle to recover. It may also allow remote attackers to execute arbitrary code on the device or leak sensitive memory contents like audio buffers or network metadata. Exploitation requires only unauthenticated remote audio stream input.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized memory access or code execution, potentially exposing sensitive data processed by the ESP32-audioI2S library. Such data exposure may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if audio metadata or streams contain regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable remote audio stream processing or network metadata parsing on vulnerable ESP32 devices. Block incoming audio streams with HTML entity strings or sanitize inputs to limit HTML entity length. Update to a patched library version once available. Isolate affected devices from critical networks until mitigation is applied.

Useful 0 Not Useful 0