Azahar 2126.2 fixes a flaw that let a crafted 3DS file run code on your computer

A security researcher showed a crafted homebrew file escaping the 3DS emulator to launch programs on Windows and run shell commands on Linux. The fix is in Azahar 2126.2, released on 8 October.

AI-drafted from 3 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

Anyone playing 3DS games on Azahar should update to version 2126.2, which came out on 8 October. The release fixes what its notes call an oversight that allowed specially crafted CIA files to execute arbitrary code in the host environment when installed by a user. In other words, a file built for the purpose could break out of the emulated 3DS and run programs on the computer or phone running Azahar. The team advises users to update as soon as is convenient.

What the advisory says

The security advisory, published the same day and credited to redthing1 of the V12 Security team, describes two bugs in the code Azahar uses to emulate the 3DS install service. One leaked leftover memory from the host to the emulated console, which revealed where things sat in memory. The other let the emulated software copy its own data to a location outside the space it was given. Used together, they let code inside the emulator take control of the Azahar process.

The researcher's proof of concept is a single homebrew file that worked on the official Windows and Linux x64 builds of version 2126.1.2, in the default configuration and with the operating system's memory protections on. On Windows it opened the Calculator. On Linux it ran a shell command. The advisory says such a file can access the user's files and network and launch programs, with the same rights as Azahar itself, and that loading it through the normal file picker was enough. GitHub lists the severity as high, while the report's own text calls it critical.

Who is affected

The advisory says the vulnerable code is present in every stable Azahar release from 2120 through 2126.1.2, and marks 2126.2 as the patched version. The fix, in pull request 2648 by PabloMK7, is listed under all platforms in the changelog. Updated builds are on the release page for Windows, macOS, Linux and Android, along with libretro cores for several systems. Until you have updated, the safe course is not to open or install 3DS files from sources you do not trust.

Also in the release

The update brings several fixes backported from the development branch. The xBRZ texture filter now looks right on the Vulkan renderer, large downloads inside emulated software are handled better, which fixes downloading large games from the eShop, and a new 3GX loader flag lets plugins load for homebrew apps. On Android, a crash when the GPU drivers folder held a subfolder is fixed. Changes to the desktop GDB and RPC servers break compatibility, so script developers need to update their RPC client.

Sources

• Azahar 2126.2 (GitHub)
• Azahar AM install-file guest-to-host code execution (GitHub)
• core: am: Fix behaviour and OOB memory access issues (GitHub)

Image: Image: Azahar project logo