Description

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took the 16-bit TLV field data_length straight off the wire and passed it to pb_istream_from_buffer(frame.data_value, frame.data_length) without checking it against the frame length or the receive buffer. frame.data_value sits 26 bytes into a 3188-byte stack object, so a data_length of up to 0xFFFF makes pb_decode() read up to roughly 62 KB past the end of that object. Only the first fragment of a fragmented control response carries a TLV header; the pre-fix driver performed half-duplex SPI transactions and silently discarded any frame the co-processor queued while the host was transmitting (esp_hosted_hal_spi_transfer() aliased the RX buffer onto the TX buffer). When the discarded frame is the first fragment of a fragmented response, the driver treats the next fragment as a new frame — its per-fragment header and checksum are genuine, so both validation steps pass — and reads the TLV header out of raw protobuf continuation bytes. Those bytes come from control responses whose size and content an adjacent, unauthenticated attacker can influence, notably the AP scan list, which grows with the number and SSID length of access points in radio range. The impact is denial of service rather than disclosure. Reading past the end of the RAM region faults the device, and CONFIG_NANOPB_ENABLE_MALLOC is selected by the driver, so garbage length prefixes read out of bounds also drive heap allocations. The out-of-bounds bytes themselves do not reach the application: pb_decode() is started mid-stream on raw protobuf continuation bytes and so almost always fails outright, and anything that did decode would still have to pass esp_hosted_response(), which requires an exact msg_id match against the pending request, and then esp_hosted_ctrl_response(), which requires a success resp — an attacker influences the size and content of legitimate control responses, not the structure decoded out of misaligned bytes. Two related defects in the same receive path make the denial of service permanent: the fragment reassembly guard was sized with ESP_FRAME_SIZE instead of ESP_FRAME_MAX_PAYLOAD and, when tripped, returned from the sole RX thread instead of dropping the frame, and unhandled control events were queued with k_msgq_put(..., K_FOREVER) on an eight-entry queue that nothing drains, blocking that same thread. The driver has no watchdog or restart path, so either condition ends all Wi-Fi reception until the device is rebooted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T22:16:56.333Z",
  "pubdate": "2026-09-21T22:16:56.333Z",
  "executiveSummary": "The Espressif ESP-hosted Wi-Fi driver, located in drivers/wifi/esp_hosted/, suffers from an out-of-bounds (OOB) memory read vulnerability due to improper input validation in the SPI frame parsing logic. The vulnerability resides within the esp_hosted_event_task() function, which processes control frames received from the ESP co-processor.\nBy failing to validate the 16-bit TLV data_length field against the actual frame size and buffer boundaries, the driver allows pb_decode() to read up to 64 KB of memory past the intended stack object. An adjacent, unauthenticated attacker within radio range can influence the contents of fragmented control responses to trigger this condition.\nThe primary impact is a persistent Denial of Service (DoS). While the vulnerability allows for OOB reads, the nature of the protobuf structure and the strict validation requirements of esp_hosted_ctrl_response() prevent unauthorized data disclosure. Instead, the out-of-bounds access causes a device fault. Furthermore, secondary flaws in fragment reassembly and queue management result in a complete loss of Wi-Fi functionality, requiring a device reboot to recover. The lack of recovery mechanisms, such as a watchdog timer, makes the resulting DoS permanent.",
  "technicalDetails": "The root cause of the vulnerability is the trust placed in the data_length field of the Type-Length-Value (TLV) header within the SPI control frames. In the esp_hosted_event_task() function, the driver passes the frame.data_length field directly to pb_istream_from_buffer without verifying it against the actual SPI receive buffer or the frame structure limits. Since frame.data_value is located 26 bytes into a 3188-byte stack-allocated structure, a malicious value of 0xFFFF allows the nanopb decoder to attempt an OOB read of approximately 62 KB of stack memory.\nThe attack flow relies on exploiting the driver's fragmented frame handling logic. The driver employs a half-duplex SPI transfer mechanism where RX buffers are aliased to TX buffers. If the host is transmitting during a co-processor SPI queue operation, the initial frame—potentially the first fragment of a multi-part control response—is discarded. The driver then treats the next received fragment as a new, standalone frame. Because the fragment headers and checksums remain valid, the driver attempts to parse the raw continuation bytes of a previous protobuf stream as a new TLV header.\nAn unauthenticated attacker can influence the contents of these control responses (e.g., by manipulating the AP scan list length and content). By forcing the driver to process misaligned bytes as a header, the attacker supplies a controlled length field that forces the decoder to read into adjacent memory regions. This triggers a memory access violation or faults the device due to invalid pointer dereferencing. Additionally, the driver uses CONFIG_NANOPB_ENABLE_MALLOC, causing the heap to allocate based on the corrupted length prefixes.\nPersistence of the DoS is exacerbated by two secondary logic flaws. First, the fragment reassembly guard is incorrectly sized using ESP_FRAME_SIZE rather than the appropriate ESP_FRAME_MAX_PAYLOAD, causing the driver to return from the RX thread prematurely when triggered. Second, unhandled control events are placed into an eight-entry message queue using k_msgq_put with a K_FOREVER timeout. If this queue is not drained, the RX thread blocks indefinitely. The absence of a watchdog or error recovery mechanism ensures that the Wi-Fi stack remains non-functional until a full system reset occurs."
}