GHSA-4jc2-x5hv-46fq: Potential out-of-bounds read in _ux_host_class_audio_device_type_get()
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55098 |
Severity |
Low |
CWE |
|
Published |
2025‑10‑17 |
Last updated |
2025‑10‑17 |
Description
The _ux_host_class_audio_device_type_get() function traverses the USB audio configuration descriptor to extract the device type by locating the Class-Specific Interface Header Descriptor (CS_INTERFACE + CS_HEADER).
This descriptor indicates which audio streaming interfaces are associated with the control interface.
The vulnerability lies in how the function parses descriptor[7], which specifies the number of streaming interface numbers listed in the descriptor starting at descriptor[8].
The loop:
for (i = 0; i < descriptor[7]; i++)
{
if (descriptor[8 + i] == interface_number)
does not verify that total_descriptor_length is large enough to include 8 + descriptor[7] bytes. If the descriptor is malformed or truncated, this loop may read past the end of the descriptor buffer, resulting in an out-of-bounds read.
A malicious USB device could exploit this by crafting a descriptor with a high value in descriptor[7] while providing fewer actual bytes—potentially causing host crashes or leaking adjacent memory.
code:
UINT _ux_host_class_audio_device_type_get(UX_HOST_CLASS_AUDIO *audio)
{
...
descriptor = audio -> ux_host_class_audio_configuration_descriptor;
total_descriptor_length = audio -> ux_host_class_audio_configuration_descriptor_length;
...
while (total_descriptor_length)
{
/* Gather the length, type and subtype of the descriptor. */
descriptor_length = *descriptor;
descriptor_type = *(descriptor + 1);
descriptor_subtype = *(descriptor + 2);
...
switch (descriptor_type)
{
...
case UX_HOST_CLASS_AUDIO_CS_INTERFACE:
...
switch (descriptor_subtype)
{
...
case UX_HOST_CLASS_AUDIO_CS_HEADER:
...
for (i = 0; i < descriptor[7]; i ++) <-- could run out of bound
{
if (descriptor[8 + i] == interface_number)
{
descriptor_found = UX_TRUE;
break;
}
}
...