# [WiiU/Switch] Remote code execution inside the ENL library

ENL library's Buffer::set lacked a capacity check, letting oversized PIA packets heap-overflow a player buffer and corrupt an adjacent enl::Buffer pointer, enabling RCE on Wii U/Switch.

- Payout: hidden
- Severity: high
- Program: Nintendo
- Found by: crazy_man123
- Disclosed: 2023-08-11
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1541273
- Library page: https://bugbountylibrary.com/r/h1%3A1541273
- Tags: area:devices domain:iot domain:network impact:dos impact:rce kind:bounty platform:hackerone sev:high technique:reverse-engineering vuln:dos vuln:memory-corruption vuln:rce

**Target:** ENL networking library content transporter receive buffers (Wii U / Switch games)
**Root cause:** enl::Buffer::set(data, size) performed a memcpy and updated the size field without verifying size <= capacity. Receive logic also failed to bound incoming data against the global receive buffer (0x442 bytes) and per-content-transporter receive buffers.
**Steps:**
1. Craft a PIA packet containing an ENL message: `uint8` content transporter ID, `uint16` data length, then data whose length exceeds the target content transporter receive buffer.
2. Send the packet to the victim; TransportManager passes it to enl::Buffer::set, which memcpy's past the PlayerBuffer capacity (heap overflow).
3. Overwrite the enl::Buffer pointer (MagicBuffer) stored immediately after the receive buffer, pointing it at controlled data or a stack address (Wii U has no ASLR; Switch is little-endian so low bytes can be overwritten).
4. Craft an enl::Buffer entry at the controlled address; additional logic copies PlayerBuffer data into MagicBuffer, writing to the attacker-chosen address.
5. Point MagicBuffer at a stack address and place a ROP chain to achieve code execution.
**How found:** Reverse-engineered the ENL TransportManager receive path and enl::Buffer implementation, noticing set() was a bare memcpy with no capacity check and that a buffer pointer sits directly after each receive buffer.
**Exploitation:** Attacker sends oversized ENL messages over PIA UDP to a victim in a match. The heap overflow corrupts the adjacent MagicBuffer pointer; a subsequent copy from PlayerBuffer to MagicBuffer yields an arbitrary write to a controlled address, used to pivot to a stack ROP chain. RCE demonstrated only for Mario Kart 8 on Wii U.
**Escalation:** Chaining with other vulnerabilities could give full device access; DoS achievable via the same overflow.
**Insight:** In closed console networking libraries, map the heap layout around per-player receive buffers: an adjacent object pointer after an unchecked memcpy turns a plain overflow into a controlled arbitrary write, especially on targets without ASLR.