Switch 2 security hit by software-only partial jailbreak

How the exploit works

A security researcher has demonstrated a software-only partial jailbreak of the Switch 2. The hack relies on the original Switch version of SmileBasic 4, a programming environment and interpreter that runs on Nintendo hardware. The so-called tethered hack also requires access to a macOS or Linux PC on the same network to run a node.js package that helps enable privileged system access. Researcher Sammy Hajhamid, who goes by Pepsipu online, writes that he used OpenAI's Codex to examine SmileBasic's language interpreter. His custom harness could send USB commands to the system, view results via HDMI, and power cycle the console through a Bluetooth light switch flipping device.

After substantial effort for about two weeks, that harness found a 32-bit integer overflow that occurs when removing items from an array in SmileBasic. That error gives access to an array pointer, which in turn allows read and write access to portions of system memory. Hajhamid then searched for access to the Switch 2's internal sysmodules. He found a buffer overflow in the console's FileSystem services module that exposed a cached data pointer, granting arbitrary read and write privileges. From there, he could execute privileged filesystem actions and eventually achieve native code execution through a faked filesystem process.

What access it provides

The exploit grants "userland" access. Hajhamid says it lets users run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2's peripherals through MMIO. He showed modded characters in Mario Kart World as a proof of concept. Others are showing simple demos and in-progress developer tools running on exploited hardware.

Still, the current userland exploit keeps Switch 2 homebrew developers in a relatively small sandbox. It falls short of the kernel-level access that would provide full control of the hardware.

Delisting and likely patching

The SmileBasic name may be familiar because the 3DS version of the same software was key to the smilehax exploit on that handheld in 2016. Nintendo removed SmileBasic from the 3DS eShop shortly after that hack became public. SmileBasic 4 has similarly been delisted from the Switch eShop worldwide, although a Japanese demo version that may work similarly is still accessible as of this story's publication. That delisting could help slow the spread of the exploit to owners who have not previously purchased or downloaded SmileBasic.

Others in the Switch 2 hacking community are already teasing similar exploits that appear to work using other games. The current exploit works on the latest Switch 2 firmware version, 23.0.1, but this particular vulnerability seems likely to be patched in imminent firmware releases, which will be required for continued access to many Nintendo services and future game releases. The hack is not as problematic as the unpatchable original Switch exploit that surfaced in 2018, which required a complete hardware redesign. Even so, the fact that Switch 2 hackers have gotten this far just over a year after the console's release is not a good sign for the overall impregnability of Nintendo's system software.

Sources: Ars Technica