Nintendo Switch Local Wireless Multiplayer Flaw Allowed Remote Pre-Auth Stack Buffer Overflows

A critical pre-authentication memory corruption flaw in the Nintendo Switch operating system (Horizon OS) allowed remote adversaries positioned within local Wi-Fi range to achieve control-flow hijacking without requiring user interaction or console pairing. Documented in coordinated public disclosure via HackerOne (Report #3770768) by security researcher moehw, the vulnerability resides in the ldn system service, which operates an ad-hoc Dynamic Host Configuration Protocol (DHCP) server to support peer-to-peer wireless multiplayer sessions.

The Local Direct Network (LDN) Architecture in Horizon OS

Unlike standard online multiplayer architectures that route game traffic through centralized Nintendo Switch Online cloud servers, the Nintendo Switch incorporates a robust ad-hoc wireless protocol named Local Direct Network (LDN). When players gather in physical proximity to play multiplayer titles—such as Mario Kart 8 Deluxe, Super Smash Bros. Ultimate, or Pokémon—one console functions as the group host, establishing an ad-hoc 802.11 wireless mesh network using the console's internal Broadcom Wi-Fi chipset.

To enable seamless IP connectivity among joining peer consoles without requiring an external wireless router, the host console's ldn background system module automatically initializes an internal, lightweight DHCP server daemon. This daemon listens for incoming broadcast discovery and request frames, allocating private IPv4 network leases to nearby participating guest consoles.

Root Cause: Unchecked memmove() in Packet Reassembly

Incoming wireless frames are captured at the link layer by the console's Berkeley Packet Filter (BPF) capture subsystem and buffered into global memory. When the ldn DHCP daemon processes an incoming frame, it parses the layered network protocols (Ethernet, IPv4, UDP, and DHCP options) and reassembles the payload into a fixed-size buffer allocated on the execution stack.

The security vulnerability stemmed from an omission in length bounds verification within the reassembly routine:

// Vulnerable reassembly logic inside Horizon OS ldn daemon:
void process_dhcp_frame(const uint8_t *bpf_buffer, size_t bpf_len) {
    uint8_t stack_buffer[512]; // Fixed-size stack buffer
    
    // Parse protocol headers and extract DHCP payload length
    size_t header_size = parse_headers(bpf_buffer, bpf_len);
    size_t total_size = extract_dhcp_layer_length(bpf_buffer);

    // VULNERABLE: total_size is attacker-controlled and NEVER compared against sizeof(stack_buffer)!
    memmove(stack_buffer, bpf_buffer + header_size, total_size);
    
    // Dispatch parsed options
    handle_dhcp_options(stack_buffer);
}

Because total_size is calculated directly from the parsed length headers of the incoming DHCP frame, an external wireless client controls the integer value passed to memmove(). By transmitting a frame whose declared DHCP options exceed the 512-byte stack allocation, the memory move writes past the end of stack_buffer, overflowing the active stack frame of the ldn worker thread.

Exploitation Mechanics: Defeating ASLR with Partial Pointer Overwrite

The Nintendo Switch enforces hardware-level Data Execution Prevention (DEP / NX) and Address Space Layout Randomization (ASLR) across all userland system modules. Normally, hijacking control flow via a stack buffer overflow requires an adversary to leak memory addresses to locate Return-Oriented Programming (ROP) gadgets.

However, researcher moehw discovered an elegant architectural bypass: on 64-bit ARM architectures (AArch64), function return addresses are tracked via the Link Register (LR, register x30), which is saved onto the stack when non-leaf functions execute. The stack layout in ldn positioned the saved LR and callee-saved registers immediately contiguous to the overflowed buffer.

Because memory pages inside the ldn module are aligned on 64 KB boundaries, the higher-order bytes of code addresses remain constant relative to the randomized ASLR base. By overwriting only the lower 2 bytes of the saved LR, the attacker redirects the processor's Program Counter (PC) to an arbitrary instruction sequence within the ldn module's own text segment—achieving deterministic ROP control without requiring a prior memory disclosure leak!

Threat Modeling: Drive-By Wireless Exploitation at Esports Arenas

The characteristics of this vulnerability made it exceptionally dangerous for gaming communities:

• Zero Pairing Requirement: The exploit fires pre-authentication. An attacker does not need to enter a room password, share friend codes, or be accepted into a lobby.
• Over-the-Air Transmission: A malicious actor equipped with a standard Wi-Fi adapter operating in packet injection mode can transmit the exploit from up to 30 meters away.
• Target-Rich Public Venues: Highly crowded gaming environments—such as competitive esports tournaments, anime conventions, airports, and public transit—frequently host active Nintendo Switch local multiplayer lobbies, enabling automated worm-like propagation or targeted console crashing.

Remediation & Horizon OS Firmware Hardening

Nintendo resolved the vulnerability through an official Horizon OS System Update. The patched ldn binary enforces strict bounds checking:

// Remediated packet ingestion logic in Horizon OS update:
if (total_size > sizeof(stack_buffer)) {
    // Drop malformed frame immediately; log security telemetry event
    drop_frame(bpf_buffer);
    return;
}
memmove(stack_buffer, bpf_buffer + header_size, total_size);

Console owners should ensure their systems are updated to the latest available Nintendo Switch system firmware. Esports event coordinators should configure dedicated wired Ethernet adapters (via the official Nintendo Switch Dock LAN port) for tournament play to eliminate wireless attack surfaces.