ESP-IDF vulnerabilities

Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.

A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.

ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.

In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.

In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.

ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.