GHSA-2ch9-p8xv-fwp6: USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.

_ux_host_class_pima_object_handles_get sizes its receive buffer from the object count the session already holds, as (nb_objects + 1) * 4. It then reads the handle count from the first four bytes of the device’s GetObjectHandles response and uses that count to drive the unpacking loop. The count is validated only against the caller’s destination array, never against the buffer the response was received into. A device that reports more handles than the host currently knows about therefore walks the source cursor past its allocation.

The same pattern — destination bounded, source cursor unbounded — affects _ux_host_class_pima_device_info_get, _ux_host_class_pima_object_info_get and _ux_host_class_pima_storage_info_get, where device-controlled string and array lengths advance a cursor through a fixed-size response buffer without being held against its end.

A hostile or compromised MTP/PTP device, or one impersonating a camera or phone, leaks host heap memory into the enumerating application, or crashes the host stack. It requires only that the device be attached and enumerated; no application action beyond normal use is needed.

Any build that includes the PIMA host class and enumerates an MTP or PTP device. Products that do not build the PIMA host class are unaffected.

Every release up to and including 6.5.1.202602 is affected.

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H — 4.9, Medium.

Fixed in USBX 6.5.2.202603. A reported handle count larger than the receive buffer sized for it is refused rather than trimmed, so a device that reports an impossible count produces an error instead of a silently truncated list. The string and array walks in the sibling functions are bounded against the end of the response buffer at every step, and an early return that previously leaked the receive buffer now releases it.

None beyond not enumerating untrusted MTP/PTP devices.

Reported by @Microsvuln. Fixed by Frédéric Desbiens (@fdesbiens). The fix was produced with AI assistance under human review, in accordance with the Eclipse Foundation’s Generative AI Usage Guidelines.