### Vulnerability Overview - **Vulnerability Name**: Potential thread stack overflow in main #4332 - **Vulnerability Type**: Thread Stack Overflow - **Vulnerability Description**: In the `flipperzero-firmware` project, the `main` thread function has a potential risk of stack overflow. Specifically, the stack size allocated for the `main` thread is 1024 bytes, but under certain detailed configurations, the actual required stack space may reach 1464 bytes. ### Impact Scope - **Affected Component**: The `main` thread in the `flipperzero-firmware` project - **Specific Scenario**: After adding the `-ffstack-usage` option in the `cc.scons` configuration file, building the `flipperzero-firmware` project allows detection of the `main` thread's stack usage. Under certain detailed configurations, the `main` thread's stack usage may exceed 1024 bytes, leading to a stack overflow. ### Remediation Plan 1. **Increase Stack Size**: - Modify the linker script `targets/FF/stm32wb55xx_flash.ld` to increase the `main` thread's stack size from 1024 bytes to 2048 bytes. ```ld /* Change from: */ _stack_size = 1024; /* To: */ _stack_size = 2048; ``` 2. **Optimize Code Structure**: - Refactor the `flipper_update_process_manifest` path to reduce its stack frame size by 920 bytes. - Change the allocation of the `update_manifest_init_mm` structure from the stack to the heap. 3. **Considerations for STM32WB55**: - Since the MCU has 256KB of SRAM, increasing the `main` thread stack to 2048 bytes is feasible and incurs low cost. ### POC Code - **POC Code**: ```ld /* Change from: */ _stack_size = 1024; /* To: */ _stack_size = 2048; ``` ### Additional Information - **CVE ID**: CVE-2026-30363 - **Author**: k6dpvmm8-glitch - **Commenters**: bad-antics, herbenderbier