Metalware Discovers DoS Vulnerability in Analog Devices MAX32655

The MAX32655 is a low-power, high-performance microcontroller based on the Arm Cortex‑M4 processor with a floating-point unit (FPU) and Bluetooth 5.2 connectivity. Designed for demanding applications, this microcontroller is widely deployed in industries such as:

Industrial IoT: For sensor hubs, data acquisition devices, and process control systems.

Medical Devices: Where reliability and low power consumption are paramount.

Wearable Technology: Including health monitors and fitness trackers.

Automotive Applications: For in-vehicle telematics and diagnostics.

Given its role in critical systems, any vulnerability within its firmware can pose a significant risk—ranging from operational disruptions to safety hazards.

The Vulnerability: Denial-of-Service via UART Payload

Our research focused on the terminal command parser implemented in the Cordio library (part of the MAX32655 MSDK). This component handles input received over the UART interface, parsing commands that control device behavior. Metalware discovered that a carefully crafted input consisting solely of quotes and whitespace characters can trigger a null pointer dereference, effectively causing a denial-of-service (DoS) condition.

How Does It Happen?

The vulnerability lies within the terminalExecute() function in the firmware’s terminal.c file. This function is responsible for parsing the input command into arguments and then dispatching the corresponding command handler. Here’s a simplified look at the problematic code section:

c
static void terminalExecute(char *pBuf)
{
  uint32_t argc = 0;
  char *argv[TERMINAL_MAX_ARGC + 1];
  uint32_t length;
  char *pBufCur;
  int state;

  enum {
    STATE_OUTSIDE_OF_ARG,
    STATE_JUST_GOT_QUOTE,
    STATE_INSIDE_OF_ARG,
    STATE_INSIDE_OF_ARG_IN_QUOTES
  };

  /* Parse arguments in command */
  state  = STATE_OUTSIDE_OF_ARG;
  length = strlen(pBuf);
  for (pBufCur = pBuf; pBufCur < pBuf + length; pBufCur++)
  {
    switch (state)
    {
      case STATE_OUTSIDE_OF_ARG:
        if (*pBufCur == '\"')
        {
          state = STATE_JUST_GOT_QUOTE;
        }
        else if (!TERMINAL_IS_SPACE(*pBufCur))
        {
          state = STATE_INSIDE_OF_ARG;
          if (argc < TERMINAL_MAX_ARGC)
          {
            argv[argc] = pBufCur;
          }
          argc++;
        }
        break;

      case STATE_JUST_GOT_QUOTE:
        if (argc < TERMINAL_MAX_ARGC)
        {
          /* BUG: Incorrect index used here. It should be argv[argc] */
          argv[state] = pBufCur;
        }
        argc++;
        if (*pBufCur == '\"')
        {
          state = STATE_OUTSIDE_OF_ARG;
          *pBufCur = '\0';
        }
        else
        {
          state = STATE_INSIDE_OF_ARG_IN_QUOTES;
        }
        break;

      // ... additional state handling omitted for brevity ...
    }
  }

  /* Command dispatch logic follows */
  if (argc > 0)
  {
    terminalCommand_t *pCommand = terminalCb.pFirstCommand;
    while (pCommand != NULL)
    {
      if (strcmp(pCommand->pName, argv[0]) == 0)
      {
        break;
      }
      pCommand = pCommand->pNext;
    }
    // Further command execution logic...
  }
}

What’s Wrong?

The flaw is subtle but impactful:

In the STATE_JUST_GOT_QUOTE case, instead of storing the pointer at argv[argc], the code erroneously writes to argv[state].

Since state is defined via an enumeration (and is not guaranteed to match the current argument count), this mis-indexing can leave argv[0] uninitialized.

Later, when the command dispatcher calls strcmp(pCommand->pName, argv[0]), it may dereference a NULL or garbage pointer, leading to a crash.

An attacker who sends a UART payload composed only of quotes and whitespace can exploit this behavior to crash the device, resulting in a denial-of-service (DoS) attack. In mission-critical systems—like industrial control or medical devices—such disruptions can be catastrophic.

Potential Impact on Industry Applications

The MAX32655 is often deployed in environments where reliability is critical:

Industrial Automation: A DoS attack could halt production lines or disrupt sensor networks, leading to significant downtime and financial losses.

Medical Devices: Interruption of device functionality could compromise patient monitoring or treatment delivery, posing serious health risks.

Automotive Systems: In-vehicle devices experiencing a crash could affect diagnostics or safety systems, undermining vehicle reliability.

In each of these scenarios, a vulnerability in the firmware’s command parser not only threatens operational continuity but also endangers safety and trust in the technology.

How Metalware Firmware Fuzzer Uncovered the Bug

Our Metalware firmware fuzzer is engineered to rigorously test firmware by injecting a wide array of input sequences, including edge-case data that developers might not anticipate. During routine fuzzing of the MAX32655’s UART interface, Metalware identified abnormal behavior when processing input containing only quotes and spaces.

By continuously mutating the input and monitoring the system’s response, Metalware was able to trigger the null pointer dereference in the terminalExecute() function. The automated discovery of such a nuanced bug reinforces Metalware’s capability to uncover critical vulnerabilities in embedded firmware—before they can be exploited in the field.