CVE-2021-42553: STM32 USB Host Library Buffer Overflow
A buffer overflow vulnerability in stm32mwusbhost of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBHMAXNUMENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-42553?
CVE-2021-42553 is a buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1.
How can an attacker exploit CVE-2021-42553?
An attacker can exploit CVE-2021-42553 by providing a descriptor with more endpoints than USBH_MAX_NUM_ENDPOINTS, leading to arbitrary code execution.
What is the severity of CVE-2021-42553?
CVE-2021-42553 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2021-42553?
Versions of stm32_mw_usb_host before 3.5.1 are affected by CVE-2021-42553.
How can I fix CVE-2021-42553?
To fix CVE-2021-42553, upgrade to version 3.5.1 or newer of stm32_mw_usb_host.