CVE-2022-29223: azure-rtos usbx Classic Buffer Overflow

Vulnerability summary

CVE-2022-29223 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in azure-rtos usbx. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.5% of scored vulnerabilities.

Timeline

1. 24-05-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with `bNbPorts` set to a value greater than `UX_MAX_TT` which defaults to 8. For a `bNbPorts` value of 255, the implementation of `ux_host_class_hub_descriptor_get` function will modify the contents of `hub` -> `ux_host_class_hub_device` -> `ux_device_hub_tt` array violating the end boundary by 255 - `UX_MAX_TT` items. The USB host stack needs to validate the number of ports reported by the hub, and if the value is larger than UX_MAX_TT, USB stack needs to reject the request. This fix has been included in USBX release 6.1.10.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.