Nintendo Switch Mario Kart 8 Deluxe Pia P2P Stack Buffer Overflow Vulnerability Analysis

Key Information 1. Vulnerability Description: - Vulnerability Type: Stack buffer overflow and potential RCE (Remote Code Execution) - Affected Component: PIA (LAN/LDN, possibly NEX) room info deserialization - Affected Platforms: Nintendo Switch, PIA/MK8DX 2. Vulnerability Background: - Discovery Date: July 18, 2024 - Report Submission: July 18, 2024 - Internal Handling: July 31, 2024 - Patch Release: September 11, 2024 (v3.0.3) - Patch Release: September 27, 2024 (China region) 3. Vulnerability Impact: - Exploitation: Could lead to remote code execution (RCE) in user mode. - Fix Status: Patch released. 4. Vulnerability Severity: - Severity Level: Medium (4.3) 5. Vulnerability Disclosure: - Disclosure Date: September 29, 2024 - Disclosure Method: Disclosed by Nintendo 6. Vulnerability Details: - Exploitation: Due to misuse of the "CopyAppData" function in the Pia P2P network library; when outBufSize exceeds the size of the out buffer, it may lead to RCE. - Fix: Patch v3.0.3 released. 7. Exploitation Tools: - Exploit Tools: No publicly mentioned exploitation tools. 8. Public Exposure: - Exposure Status: Not public (Hidden) Related Links GitHub Repository: https://github.com/latte-soft/kartlanpwn Summary This vulnerability stems from improper use of the Pia P2P network library in the Nintendo Switch game Mario Kart 8 Deluxe, potentially leading to remote code execution in user mode. The vulnerability was discovered and reported to Nintendo on July 18, 2024. Nintendo released a fix on September 11, 2024 (version v3.0.3), and publicly disclosed the vulnerability on September 29, 2024.

Goal Reached Thanks to every supporter — we hit 100%!

Nintendo Switch Mario Kart 8 Deluxe Pia P2P Stack Buffer Overflow Vulnerability Analysis