Executive brief
The Striso control firmware, used in musical instruments and controllers, contains a memory management flaw in its audio jack handling component. An attacker or a specific sequence of hardware interactions could cause the device's internal memory to overflow, potentially leading to system instability or a complete device crash. This affects the reliability of the device during operation and could disrupt performances or recording sessions.
Technical details
A stack-based buffer overflow exists in the `AuxJack` thread function within `aux_jack.c` of the striso-control-firmware. The firmware allocates a working area (`waAuxJack`) of 128 bytes for the thread; however, static analysis of the call graph (including functions like `aux_jack_switch_mode`, `codec_linein_enable`, and `i2cMasterTransmitTimeout`) indicates a cumulative stack usage of approximately 200 bytes. This discrepancy can lead to a thread stack overflow during execution. While the current report is based on static analysis and stack usage tools, an exploit could lead to memory corruption or a denial-of-service (system crash) on the embedded device.
Affected products
- Striso striso-control-firmware 54c9722
Timeline
- 2024-12-05: disclosed: Issue reported on GitHub repository
- 2026-05-13: advisory: CVE published by NVD/MITRE