19
edits
Changes
ntrcardhax description
|-
|-
| ntrcardhax
| ntrcardhax
|
| When reading the banner of a NTR title, Process9 relies on a hardware register to know when the banner was fully read.
However that register is shared between the ARM9 and the ARM11.
An attacker with k11 control can so make Process9 believe the banner continues forever and so trigger a buffer overflow.
With a custom banner for a NTR flashcart, this leads to code execution in Process9.
This was fixed by adding bound checks on the read data.
| ARM9 code execution
| ARM9 code execution
| 10.4.0-29
| [[10.4.0-29|10.4.0-X]]
|
|
| March 2015
| March 2015