Nintendo Switch has fans across the world; the gaming console has garnered success worldwide and has remained in high demand since it was launched last year. According to Katherine or Kate Temkin, the Switch’s Nvidia Tegra X1’s USB recovery mode has a serious hardware flaw that allows running arbitrary code on all current models of the console.
The vulnerability has been dubbed as ‘Fusée Gelée’. Using the vulnerability it is possible to run custom firmware and/or homebrew games on the console. Katherine Temkin is a hacker associated with ReSwitched, a team responsible for recording information about hardware, software and general development of the Switch.
An exploit called cold-boot-hack is used to access the console hardware physically when the power-up process is underway to perform the attack. It allows circumvention of lock-out operations, which generally serve as chip’s bootROM protectors.
Sending what is known to tech experts as a ‘bad length’ argument to an inappropriately coded USB control process is possible for the users to request huge proportions of data for each control request. The data volume overflows a direct memory access buffer that lies within the bootROM. Received data is then transferred into a protected application stack leading to the running of the arbitrary code.
See: Nintendo Switch Hacked to Run Pirated Games
What’s even more concerning is the fact that many other gadgets use Tegra X1 chips just like the Switch. So this means, asserts Temkin, the issue is not limited to the latest Nintendo Switch but is present in all Nintendo Switches that use the same chip.
To rectify the issue hardware revision is required but it must be noted that the bootROM is open to minor factory patches only and not for extensive updating. This is a chip-level flaw and is going to create problems for Nintendo as it cannot be fixed by merely releasing an update. But Temkin is of the opinion that the flaw is not totally bad; it is its immutability that makes it a somewhat good thing from a security perspective.
“Fusée Gelée isn’t a perfect, ‘holy grail’ exploit, though in some cases it can be pretty damned close,” stated Temkin.
“If it were possible to apply patches to the bootROM after a unit had been shipped, anyone with a sufficiently powerful exploit would be able to make their own patches, bypassing boot security. It also means that any Switch currently affected will continue to be able to use Fusée Gelée throughout its life,” said Temkin.
A proof-of-concept has been created by Temkin; it is a Python program and a payload as well that can be used to display information that generally is protected from the bootROM. Temkin also revealed that Nintendo and Nvidia have already been informed about the problem and the only reason she chose to disclose it publicly is that of the probability that the flaw might be discovered by malicious threat actors.
This isn’t the first time that a flaw has been identified in the Switch since previously there were reports about discovering a permanent boot exploit that allowed hackers to execute unsigned code. After few weeks, fail0verflow managed to convert it into a fully-featured Linux tablet and now it has a chip level flaw that can let users run homebrew games on the console.
Jokes aside, we have a 90-day responsible disclosure window for ShofEL2 ending on April 25th. Since another person published the bug so close to our declared deadline, we're going to wait things out. Stay tuned.
— fail0verflow (@fail0verflow) April 23, 2018
Watch the demonstration shard by Fail0verflow:
Image credit: Depositphotos
More: Hackers Exploit Tegra Chipset Flaw to Run Linux OS on Nintendo Switch
