Vulnerability · Published May 24, 2022 · Assigned by GitHub_M

CVE-2022-29223Buffer overflow on HUB descriptor in Azure RTOS USBX

High 7.5

In plain English

A high-severity buffer overflow in usbx from azure-rtos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.2%top 30.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with `bNbPorts` set to a value greater than `UX_MAX_TT` which defaults to 8. For a `bNbPorts` value of 255, the implementation of `ux_host_class_hub_descriptor_get` function will modify the contents of `hub` -> `ux_host_class_hub_device` -> `ux_device_hub_tt` array violating the end boundary by 255 - `UX_MAX_TT` items. The USB host stack needs to validate the number of ports reported by the hub, and if the value is larger than UX_MAX_TT, USB stack needs to reject the request. This fix has been included in USBX release 6.1.10.

Affected products (as reported)

Vendor	Product	Versions
azure-rtos	usbx	< 6.1.10

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/azure-rtos/usbx/security/advisories/GHSA-2qc5-385m-x862 x_refsource_CONFIRM
https://github.com/azure-rtos/usbx/releases/tag/v6.1.10_rel x_refsource_MISC