AI News

A security audit of the closed ESP32-C6 Wi-Fi stack identified two memory-safety issues and documented how both fixes reached shipping ESP-IDF. ESP-001 is a remotely reachable, pre-association heap out-of-bounds write in the proprietary libnet80211 MBSSID beacon-reconstruction path. The reconstruction expands compressed Multiple-BSSID profiles into a pooled buffer without checking destination capacity. The researcher measured that buffer at 1,700 bytes over JTAG, calculated a 1,572-byte write threshold, and reproduced the predicted behavior on a running chip: a near-maximum crafted beacon reconstructed to about 1,644 bytes, while a 1,490-byte test remained below the boundary. A monitor-mode Wi-Fi adapter bypassed the ESP injector’s 1,500-byte transmission limit and delivered 1,680-1,690-byte test frames. The issue can corrupt heap memory on scanning or connected devices within radio range, with denial of service as the minimum stated impact and greater impact dependent on heap layout. ESP-002 affects the hardware-GCM implementation: esp_aes_gcm_update() accepts an output-size parameter but the hardware path writes the full input length without enforcing it. The normal TLS record layer sizes buffers correctly, but direct callers relying on the documented mbedtls contract can encounter an overflow on ESP targets. The author classifies this as hardening and robustness, not remote code execution. Espressif assessed both reports as duplicates of earlier findings; neither received a CVE or advisory. The GCM fix is visible in source, while the Wi-Fi fix was verified by comparing pre- and post-update disassemblies, which showed new capacity checks and a frame-drop path. ESP-001 was fixed across supported ESP-IDF branches v5.2 through v6.1, while ESP-002 was fixed across active branches. The audit was carried out largely by autonomous agents controlling real devices, decompilation, JTAG measurements, and patch comparison, illustrating how AI-assisted hardware testing can accelerate both vulnerability discovery and defensive verification.