GHSA-j253-w29r-9m48: Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()
GHSA ID |
|
|---|---|
CVE ID |
CVE‑2025‑55100 |
Severity |
Low |
CWE |
|
Published |
2025‑10‑17 |
Last updated |
2025‑10‑17 |
Description
The function _ux_host_class_audio10_sam_parse_func() parses the sampling characteristics from a USB Audio Class 1.0 descriptor. Specifically, it reads from packed_audio_descriptor, expecting it to contain a list of sampling frequencies, each encoded in 3 bytes starting from offset 8.
The number of sampling frequency entries is determined by packed_audio_descriptor[7]. However, there is no bounds check to ensure that the descriptor buffer is large enough to actually contain packed_audio_descriptor[7] * 3 additional bytes beyond offset 8.
If an attacker crafts a USB audio descriptor where packed_audio_descriptor[7] is large (e.g., 100), but the descriptor contains fewer than 8 + 3 * 100 = 308 bytes, the loop will perform out-of-bounds reads. This can lead to memory corruption, crashes, or even information leaks in a hostile USB host environment.
code:
D:\threadx\usbx-master\common\usbx_host_classes\src\ux_host_class_audio_raw_sampling_parse.c
static UINT _ux_host_class_audio10_sam_parse_func(VOID *arg,
UCHAR *packed_interface_descriptor,
UCHAR *packed_endpoint_descriptor,
UCHAR *packed_audio_descriptor)
{
...
if (packed_audio_descriptor[7] == 0)
{
...
}
else
{
/* Parse list of sampling characteristics. */
for (n = 0, offset = 8;
n < packed_audio_descriptor[7]; // <-- this value can be much larger than the descriptor
n ++, offset += 3)
{
sam_attr.ux_host_class_audio_sampling_characteristics_frequency_low =
((ULONG)packed_audio_descriptor[offset]) +
((ULONG)packed_audio_descriptor[offset+1] << 8) +
((ULONG)packed_audio_descriptor[offset+2] << 16); <-- loop could read out of bounds
...
}
}
return(0);
}