Heap Overflow in schreibfaul1 ESP32-audioI2S Library

Executive Summary

This is a heap-based buffer overflow in the ESP32-audioI2S library version 3.4.5. The vulnerability occurs in the Audio::showID3Tag() function which parses ID3 metadata from MP3 files. The function uses an unbounded appendf() operation to write attacker-controlled ID3 tag values into a fixed-size heap buffer without validating the output length. This allows malicious MP3 files with oversized ID3 tags to corrupt heap memory.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing MP3 files for oversized ID3 tags. Use tools like 'exiftool' to inspect ID3 tag lengths in audio files. Check for files with ID3 comment, title, artist, or lyric tags exceeding normal lengths (e.g., >1000 characters).

On ESP32 systems, monitor for crashes or reboots during audio playback, which may indicate heap corruption. Review logs for watchdog timer triggers or PSRAM heap errors.

Useful 0 Not Useful 0

Impact Analysis

Exploitation can cause device crashes requiring manual reboot, remote denial of service by forcing hardware watchdog resets, arbitrary code execution within the audio library's privilege scope, and memory data leaks exposing sensitive internal audio buffers and runtime data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution and data exposure. A heap-based buffer overflow may allow attackers to access or leak sensitive memory data, which could include personal or health information. Additionally, device crashes or privilege escalation could disrupt systems handling regulated data, violating availability requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using ESP32-audioI2S version 3.4.5. Replace it with a patched version once available. Avoid playing untrusted MP3 files on vulnerable devices. Implement network-level controls to block malicious audio files.

If patching is delayed, limit ID3 tag processing by truncating or validating tag lengths before parsing. Monitor device logs for crashes or heap corruption signs.

Useful 0 Not Useful 0