Azure RTOS USBX up to 6.1.11 USB DFU UPLOAD ux_device_class_dfu_control_request buffer overflow

Summaryinfo

A vulnerability classified as critical has been found in Azure RTOS USBX up to 6.1.11. This affects the function ux_device_class_dfu_control_request of the component USB DFU UPLOAD Handler. This manipulation causes buffer overflow. This vulnerability is registered as CVE-2022-39344. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in Azure RTOS USBX up to 6.1.11. Affected by this vulnerability is the function ux_device_class_dfu_control_request of the component USB DFU UPLOAD Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function prevents buffer overflow during handling of DFU UPLOAD command when current state is `UX_SYSTEM_DFU_STATE_DFU_IDLE`. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the `UPLOAD_LENGTH` check in all possible states.

The weakness was published 11/05/2022 as GHSA-m9p8-xrp7-vvqp. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2022-39344 since 09/02/2022. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/30/2026).

Upgrading to version 6.1.12 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-41817). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Azure RTOS

Name

• USBX

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion