CVE-2022-39344: azure-rtos usbx Classic Buffer Overflow

Vulnerability summary

CVE-2022-39344 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in azure-rtos usbx. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-11-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function prevents buffer overflow during handling of DFU UPLOAD command when current state is `UX_SYSTEM_DFU_STATE_DFU_IDLE`. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the `UPLOAD_LENGTH` check in all possible states.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.