GHSA-qjw8-7w86-44qj: Azure RTOS USBX Remote Code Execution Vulnerability

GHSA ID	GHSA‑qjw8‑7w86‑44qj
CVE ID	CVE‑2023‑48694
Severity	Medium
CVSS score	6.8 (`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
CWE	CWE-825, CWE-843
Published	2023‑12‑03
Last updated	2023‑12‑03

GHSA ID

GHSA‑qjw8‑7w86‑44qj

CVE ID

CVE‑2023‑48694

Severity

Medium

CVSS score

6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CWE

CWE-825, CWE-843

Published

2023‑12‑03

Last updated

2023‑12‑03

Affected packages

Package	Vulnerable versions	Patched versions
USBX	<6.3.0	6.3.0

Package

Vulnerable versions

Patched versions

USBX

<6.3.0

6.3.0

Description

Impact An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX.

Affected Components The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0.

Remediation Upgrade to v6.3.0 or above.

For more information If you have any questions or comments about this advisory: • Open an issue in azure-rtos/usbx • Post question on Microsoft Q&A