Heap Overflow in schreibfaul1 ESP32-audioI2S

Executive Summary

This is a heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library version 3.4.5. The vulnerability occurs in the WAV header parsing function read_WAV_Header(). When processing malicious WAV files, the function reads untrusted chunk size and bytes-to-skip values without proper validation. Large values cause out-of-bounds heap memory access during header parsing, potentially leading to arbitrary code execution, information disclosure, denial of service, or privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or reboots of ESP32 devices running the affected library when processing WAV files. Use tools like AddressSanitizer during development to catch heap overflows. Inspect network traffic for malformed WAV file headers with abnormally large chunk sizes.

Useful 0 Not Useful 0

Impact Analysis

Exploitation could allow attackers to crash your ESP32 device via a denial of service (watchdog reboot), execute malicious code within the audio library's privilege scope, or leak sensitive memory contents. The attack can be triggered remotely through network audio streams or locally via malicious files on an SD card without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using WAV files from untrusted sources. Update the schreibfaul1 ESP32-audioI2S library to a patched version if available. Implement input validation to restrict chunk sizes and frame lengths in WAV headers. Use sandboxing or memory protection on ESP32 devices to limit damage from potential overflows.

Useful 0 Not Useful 0