An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
Inside the hub, the livestream is handled by the video-core process, which uses ffmpeg to connect via RTSP to the smart camera in its same local network, and at the same time, provides a streamable link on the smartphone application.
We identified a vulnerable request that can be exploited to achieve code execution on the video-core process, which is running as root. By sending a POST request for the "/cameras" path, it's possible to add a new camera to the hub.
The function initially calls http_required_json_parameters at  to verify that all the required parameters are specified in the JSON request, the parameters are: cameraId, locationId, dni, url. At  the function parses the JSON payload received in the request using json_tokener_parse, which returns a json_object. It then calls sub_48438  passing the pointer to a local stack buffer and the json_object as parameters.
.text:00048444 260        MOV             R1, #:lower16:aCameraid_1     ; "cameraId"
.text:00048454 260        MOVT            R1, #:upper16:aCameraid_1     ; "cameraId"
.text:000485AC 260        MOV             R1, #:lower16:aLocationid_0   ; "locationId"
.text:000485B4 260        MOVT            R1, #:upper16:aLocationid_0   ; "locationId"
.text:000486FC 260        MOV             R1, #:lower16:aDni            ; "dni"
.text:00048704 260        MOVT            R1, #:upper16:aDni            ; "dni"
.text:00048850 260        MOV             R1, #:lower16:aUrl_0          ; "url"
.text:00048858 260        MOVT            R1, #:upper16:aUrl_0          ; "url"
.text:00048938 260        MOV             R1, #:lower16:aState          ; "state"
.text:00048940 260        MOVT            R1, #:upper16:aState          ; "state"
- Call to `json_object_object_get_ex`  and `json_object_to_json_string`  for extracting a parameter by key name.
- Copy the parameter value in a buffer on the stack, using `strlen`  and `memcpy` .
Since state is controlled by the user, there is no restriction on the length of the copy operation, which allows for overflowing the stack buffer, and potentially arbitrary code execution.
SmartThings SmartApps allow for creating custom applications that can be either published directly into the device itself, or on the public marketplace. A SmartApp is executed inside the hubCore process, and is allowed to make any localhost connection. It is thus possible for a SmartApp to send arbitrary HTTP requests directly to the vulnerable video-core process.