GHSA-2qc5-385m-x862: Potential buffer overflow on HUB descriptor

GHSA ID

GHSA‑2qc5‑385m‑x862

CVE ID

CVE‑2022‑29223

Severity

High

Published

2022‑05‑17

Last updated

2022‑05‑17

Affected packages

Package Vulnerable versions Patched versions

USBX

< 6.1.10

6.1.10

Description

Impact

An attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with bNbPorts set to a value greater than UX_MAX_TT which defaults to 8. For a bNbPorts value of 255 the implementation of ux_host_class_hub_descriptor_get function will modify the contents of hub → ux_host_class_hub_device → ux_device_hub_tt array violating the end boundary by 255 - UX_MAX_TT items.

Patches

We analyzed this bug and determined that we needed to fix it. As pointed out in the original report, our USB host stack needs to validate the number of ports reported by the hub, and if the value is larger than UX_MAX_TT, USB stack needs to reject the request. This fix has been included in USBX release 6.1.10.

Workarounds

Upgrade to v6.1.10 or above.

For more information

If you have any questions or comments about this advisory: * Open an issue in azure-rtos/usbx * Post question on Microsoft Q&A