ESP-IDF Release v3.3.6

Documentation for v3.3.6 is available at https://docs.espressif.com/projects/esp-idf/en/v3.3.6/

ESP-IDF v3.3.6 is the last bugfix update for ESP-IDF v3.3. After this release, release/v3.3 branch of ESP-IDF will not receive any more bug fixes, including fixes for security issues. Users of ESP-IDF v3.3.x are advised to upgrade to the latest stable ESP-IDF release. Please refer to the explanation of ESP-IDF support periods for more information.

At the time of writing, v4.3.2 is the latest stable release. The new v4.4 release will follow shortly.

Obtaining v3.3.6

For full installation instructions, see the ESP-IDF Programming Guide.

The source files attached to this release will not work due to our use of git submodules. Use one of the following methods instead:

Using git

To get this release, use the following commands:

git clone -b v3.3.6 --recursive https://github.com/espressif/esp-idf.git esp-idf-v3.3.6
cd esp-idf-v3.3.6/

This is the recommended way of obtaining v3.3.6 of ESP-IDF.

Download an archive with submodules included

Attached to this release is an esp-idf-v3.3.6.zip archive. It includes .git directory and all the submodules, so can be used out of the box. This archive is provided for users who have connectivity issues preventing them from cloning from GitHub.

This archive can also be downloaded from Espressif's download server:
https://dl.espressif.com/github_assets/espressif/esp-idf/releases/download/v3.3.6/esp-idf-v3.3.6.zip

Changelog

This is the list of changes since release v3.3.5:

Major Bug Fixes

• Fixed arithmetic overflow issue in FreeRTOS queue API (CVE-2021-31571)
• ESP-BLE-Mesh: Add check the value of Provisioning Random & Confirmation sent and received by Provisioner (CVE-2020-26556 & CVE-2020-26560)
• ESP-BLE-Mesh: Recommend to use OOB mechanism to exchange Public Key (CVE-2020-26559)
• ESP-BLE-Mesh: Recommend to use randomly generated AuthValue for Static OOB (CVE-2020-26557)
• Flash Encryption: Fixed potential physical access TOCTOU attack to remove encrypted partition flag in partition table (CVE-2021-27926)

Breaking Changes

• Bootloader: The default app configuration is now only compatible with bootloader and partition table generated from ESP-IDF v3.1 or newer. Apps that need to support OTA update on bootloaders and/or partition tables from ESP-IDF older than v3.1 must enable the new configuration option "App compatible with bootloader and partition table before ESP-IDF v3.1" (CONFIG_ESP32_COMPATIBLE_PRE_V3_1_BOOTLOADERS).

  Additionally, in previous v3.3.x releases the option to add MD5 hash to the partition table (CONFIG_PARTITION_TABLE_MD5) did not take effect. Because of this, projects based on CMake build system upgrading to this release over OTA also need to enable the above mentioned compatibility option. (Note, CMake based build system was first added as preview in v3.3 release.)

  This breaking change was introduced as a fix for CVE-2021-27926.

Bluetooth

Controller

• Fixed crash in Bluetooth when calling esp_restart()
• Fixed modem sleep hardware error

Bluetooth Low Energy

• Fixed controller do not report disconnection event to host
• Remove the wrong called to lld_evt_end_isr()
• Fixed hci timeout due to sleep
• Deleted the Kconfig option: BLE ADV priority high
• Fixed BLE ACL TX flush issue during reset/reboot
• Removed duplicate events in r_lld_evt_end()
• Fixed start scan crash caused by setting specific scan interval and Window
• Fixed the scanning may stop after a period of time
• Fixed connection failed with LG 5.0 phone

Classic Bluetooth

• Suppressed some warning messages such as "E8192", "ELx200", "ELx40" etc, to prevent the influences of printing logs from causing the same issue
• Fixed handling of invalid feature page response
• Fix unable to initiate SCO connection when peer device not accept sniff mode
• Fixed crash after inquiry has finished
• Fixed the issue bt_spp_acceptor example fails when SPP is initiated on a windows machine using Realtek Bluetooth adapter
• Fixed the issue HCI_Read_Clock failed read local Bluetooth Clock
• Fixed the issue create Connection request is not properly terminated which blocks BlueZ from reconnecting

Bluedroid

Classic Bluetooth

• SPP: Added API esp_spp_stop_srv_scn to stop a specific server
• SPP: Added parameter service_name with event ESP_SPP_DISCOVERY_COMP_EVT
• SPP: Added parameter scn with event ESP_SPP_START_EVT
• SPP: Added parameter scn with event ESP_SPP_SRV_STOP_EVT
• A2DP: Fixed A2DP underrun issue
• A2DP: Added A2DP Init and Deinit Complete Evt
• A2DP: Fixed A2DP deint crash
• SPP: Fixed spp acceptor deadlock
• SPP: Fixed spp memory leak
• HFP: Fixed an issue that acl can't disconnect when hfp_client disconnect
• Fixed the timer collision in function bta_sys_start_timer() used by role switch

Bluetooth Low Energy

• Added connection parameter check
• Fixed BLE connection maximum latency is 499
• Disable bluedroid congest error log print
• Fixed scan response length error in ADV report
• Fixed BLE read multi-characteristic error when the number of handles is more than 10
• Fixed bluedroid repair failed if the two most significant bits of public address is '01'
• Fixed setting scan parameters error with policy is 2 or 3 if address resolution is not enabled
• Fixed the the code analysis report error reported by customer
• Fixed some code logic errors
• Add new API to get connection parameters
• Add new connection parameters information in GATTC connection event

NimBLE

• Added change to use new API of os_mbuf_pack_chains for better memory utilizations
• Added upstream change to fix flow control
• Fix MITM vulnerability during public key exchange in secure connection
• Add SC unit test to flag error on same public key
• Added change to free the AES context after use by calling mbetls_aes_free
• Fixed the bug in deletion of peer_dev_record.
• Fixed bug in peer_dev_record and and broadcaster role build

ESP-BLE-Mesh

• Support using multiple NVS namespaces to store information by Provisioner
• Fixed deinit server models with no matching model id
• Fixed number endianness error for Provisioner when using input/output authentication
• Fixed provisioning input/output count number should be at least 1
• Replace the Zephyr integer types with C99 types
• Add check the value of Provisioning Random & Confirmation sent and received by Provisioner(CVE-2020-26556 & CVE-2020-26560)
• Recommend to use OOB mechanism to exchange Public Key (CVE-2020-26559)
• Recommend to use randomly generated AuthValue for Static OOB (CVE-2020-26557)
• Make Unprovisioned Device Beacon interval configurable
• Updated the SIG recommendations for BLE Mesh CVE issues
• Use a separate callback for BLE coexistence operations
• Support scanning normal BLE advertising packets
• Apply the errata E16350 of BLE Mesh from Bluetooth SIG
• Fixed filter error when Provisioner receiving Heartbeat messages
• Enable updating Lighting HSL state
• Fixed an issue that Proxy Client may fail to resend messages
• Use different random values for each provisioning procedure

Wi-Fi Coexistence

• Fixed assert without SW coexist enabled
• Fixed BT controller task watchdog in Wi-Fi test

Wi-Fi

• Updated exception handling for iperf example's scan when no ap was found
• Fixed smartconfig issue when router reply arp late
• Fixed setting channel error after Wi-Fi stop
• Fixed ESP-NOW channel config range
• Fixed AMSDU and fragment vulnerabilities
• Fixed resources leaks detected in static analysis
• Fixed airkiss and esptouch find channel crash issue
• Fixed softAP crash by adding NULL pointer check for handling public action frame
• Ignore dirtyBuf check when buffer size is larger than 4092
• Fixed rf signal test without 9M rate issue
• Fixed issue with hidden AP scans after connecting AP
• Fixed the watchdog issue when receiving action frame
• Clear hotspot bss when auth timeout happens
• Fixed the bug for esptouch find hidden AP fail
• Fixed issue of reason code change from 15 to 204 when provide wrong password
• Fixed set config return value error
• Fixed ampdu age timer memory leak
• Fixed PMK not saved in NVS for SoftAP for PSK mode

ESP-WIFI-Mesh

• Add esp_mesh_send_block_time to set blocking time of esp_mesh_send
• Fixed the issue that layer2 node connect to lower-layer node when FIXED-ROOT root disappeared

Ethernet

• Fixed incorrect initialization sequence (#6821)

Security

• Secure Boot v1: Added anti fault injection resistance
• Fixed invalid secure boot signing command generated in build system (#6831)
• Flash Encryption: Fixed potential physical access TOCTOU attack to remove encrypted partition flag in partition table (CVE-2021-27926)

Peripheral Drivers

• ADC: Fixed missing ranges of ADC codes on ESP32 (https://esp32.com/viewtopic.php?f=12&t=17214)
• DAC: Fixed DAC header doesn't contain GPIO header issue
• Freemodbus: Fixed rs485 rts de-assert fail when tx delayed (#6728)
• Freemodbus: Added the MB_PORT_TASK_AFFINITY kconfig option for modbus tasks (#6700)
• GPIO: Enable GPIO20 for ESP32-PICO-V3 chip package (#6918)
• MCPWM: Fixed wrong deadtime preset modes (#7321)
• PSRAM: Add support for ESP32-PICO-V3-02
• UART: Fixed uart module reset issue (#1202)
• UART: Added config to support placing UART ISR in IRAM
• UART: Fixed a typo in the error message of invalid rx_thresh_xoff

Core System

• ESP32xxx: Fixed default values for all RTC sources in the CONFIG_ESP32xx_RTC_CLK_CAL_CYCLES option
• Added esp_backtrace_print() function to dump a backtrace from the current point
• Watchdog Timers: Task WDT now prints a backtrace when triggered
• Remove core1 disable cache in cache_utils.c
• Fixed arithmetic overflow issue in FreeRTOS queue API (CVE-2021-31571)
• Fixed the internal devices/registers access corruption due to concurrent read/write by a spinlock
• Partition Table: The partition table MD5 checksum is now checked when the partition table is loaded by the app, in addition to the existing check in the bootloader
• Added dummy bytes to end of flash.text to prevent errors with CPU prefetching instructions past the end
• esp_event: Fixed and improved docs

FreeRTOS

• esp_ringbuf: Fixed an issue where comparison between a signed and unsigned operand resulted in incorrect free size for no-split/allow-split buffers (#7344)

Power Management

• Fixed printing from a critical section in esp_pm_dump_locks, improved formatting

mDNS

• Fixed length calculation of mDNS text field

HTTP Client

• Fixed buffer overread when esp_http_client_read is called after esp_http_client_perform
• Fixed esp_http_client_read with OpenSSL server for file size aligned to 289 bytes
• Fixed memory leak identified by cppcheck
• Fixed header truncated when responded header length over buffer_size
• Updated certificates of https examples

mbedTLS

• Upgraded to release v2.16.12

TCP_Transport

• Enabled TCP keep-alive function in transport level

ESP-MQTT

• Added a new API to enqueue publish messages with qos>0

Tools

• Upgraded OpenOCD to version v0.10.0-esp32-20211111
• Fixed crash of idf_monitor.py in case processing input with Unicode character
• Specify UTF-8 encoding for Eclipse Make build which is not the default value under Python 2 (#6505)
• Constrain the cryptography package version in order to avoid breaking changes
• Constrain version of the cffi package for older python <3.6

Build System

• CMake: Fixed issue where partition table md5 logic was inverted when generating the binary
• Defined IDF_VERSION_MAJOR, IDF_VERSION_MINOR, IDF_VERSION_PATCH variables during the early expansion phase of component CMakeLists.txt files

External Libraries

• expat: Updated library from 2.2.9 to 2.4.1.
• cJSON: Updated cJSON submodule to v1.7.15
• nghttp2: Upgraded to v1.41.0 release

Documentation

• Fixed command-line invoked for OpenOCD troubleshooting
• SPI: Fixed the default maximum transaction length