# [Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserialization

MK8DX passes an oversized outBufSize to Pia's LAN_CopyAppData, letting a malicious LAN browse-reply packet overflow a 128-byte stack buffer with 150 bytes of app data.

- Payout: hidden
- Severity: medium
- Program: Nintendo
- Found by: jitlua
- Disclosed: 2024-09-30
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/2611669
- Library page: https://bugbountylibrary.com/r/h1%3A2611669
- Tags: area:devices domain:network impact:rce kind:bounty platform:hackerone sev:medium tech:evm technique:source-review vuln:memory-corruption vuln:rce

**Target:** Pia P2P networking library LAN/LDN browse-reply packet deserialization
**Root cause:** MK8DX calls LAN_CopyAppData with outBufSize (150) larger than the 128-byte out buffer; the length check compares attacker-controlled appDataLength against outBufSize, not the real buffer size, so memcpy overflows the stack frame.
**Steps:**
1. Craft LAN browse-reply packet: byte 0 = `0x1`, bytes 1-4 = session info body size `1266`
2. Place application data at offset 47 (0x180 bytes region)
3. Set u32 at offset 431 to app data length <= 150
4. Send packet to peer; LAN_CopyAppData memcpy's outBufSize (150) bytes into 128-byte stack buffer, overwriting stack frame
**How found:** Researcher reviewed MK8DX's usage of the Pia library and noticed CopyAppData implementations called with outBufSize exceeding the actual out buffer bounds; located function at +0xA0F8C0 in main for v3.0.1.
**Exploitation:** Attacker on LAN/LDN sends crafted browse-reply packet to a peer; overflow of 22 bytes past a 128-byte stack buffer corrupts the stack frame. Full RCE requires chaining with an info leak to defeat ASLR; not demonstrated end-to-end in text.
**Escalation:** Potential user-mode RCE on peers' consoles if chained with an info leak.
**Insight:** When auditing a third-party networking library, check every call site's buffer-size argument against the real destination buffer size rather than trusting the library's internal length check, which may validate against the caller-supplied (wrong) size.