USBX HID Report Descriptor Parser Out-of-bounds Read Analysis and Fix

Vulnerability Summary: Out-of-Bounds Read in USBX HD Report Descriptor Vulnerability Overview Vulnerability Name: Out-of-bounds Read via Check-after-use in the USBX HD Report Descriptor Parser Vulnerability Type: Out-of-bounds Read Root Cause: A "check-after-use" logic flaw exists during the parsing of USB HID report descriptors. After reading the descriptor length, the parser fails to correctly verify whether subsequent read operations exceed buffer boundaries, potentially leading to reads from invalid memory addresses. Trigger Condition: The vulnerability is triggered when a device sends a report descriptor where the length field value exceeds the actual data length, causing the parser to attempt reading memory beyond the allocated buffer. Affected Component: HID Report Descriptor Parser within the USBX library (specifically the function). Scope of Impact Affected Products: - USBX library versions < 6.1.20082 - All embedded systems utilizing the USBX library with HID report descriptor parsing functionality enabled. Affected Platforms: - All embedded operating systems supporting USBX (e.g., ThreadX, RTEMS, FreeRTOS, etc.). - Any application relying on USBX for HID device communication. Severity Level: - CVSS v3.1 Score: 7.5 (High) - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - Impact: Confidentiality, Integrity, and Availability are all affected. Remediation Official Fixed Version: - USBX version 6.1.20082 and later include the fix for this vulnerability. Fix Method: - Implement strict validation of the descriptor length before parsing to ensure read operations do not exceed buffer boundaries. - Add additional boundary check logic within the function to prevent out-of-bounds reads. Temporary Mitigation Measures: - Restrict the length of report descriptors from USB HID devices to prevent receiving excessively long descriptors. - Implement whitelisting at the application layer to filter USB devices, allowing connections only from trusted devices. POC or Exploit Code No specific POC or exploit code is provided in the document. Exploitation requires constructing a USB HID report descriptor with a length field value greater than the actual data length and transmitting it to the target device via the USB interface to trigger the out-of-bounds read. Additional Information Vulnerability Discoverer: Nikolaus Report Date: January 1, 2024 (inferred from page information) Related CVE: No specific CVE number assigned; refer to official USBX security advisories. References: - USBX Official Documentation - USB HID Specification - Best Practices for Embedded System Security

Goal Reached Thanks to every supporter — we hit 100%!

USBX HID Report Descriptor Parser Out-of-bounds Read Analysis and Fix

More from this source