CVE-2022-29223: Buffer overflow on HUB descriptor in Azure RTOS USBX
First published: Tue May 24 2022(Updated: )
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with `bNbPorts` set to a value greater than `UX_MAX_TT` which defaults to 8. For a `bNbPorts` value of 255, the implementation of `ux_host_class_hub_descriptor_get` function will modify the contents of `hub` -> `ux_host_class_hub_device` -> `ux_device_hub_tt` array violating the end boundary by 255 - `UX_MAX_TT` items. The USB host stack needs to validate the number of ports reported by the hub, and if the value is larger than UX_MAX_TT, USB stack needs to reject the request. This fix has been included in USBX release 6.1.10.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Azure Rtos Usbx | <6.1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Azure RTOS USBX vulnerability?
The vulnerability ID for this Azure RTOS USBX vulnerability is CVE-2022-29223.
What is the severity level of CVE-2022-29223?
CVE-2022-29223 has a severity level of 9.8 (Critical).
What is the description of CVE-2022-29223?
CVE-2022-29223 is a buffer overflow vulnerability in Azure RTOS USBX that allows an attacker to cause a buffer overflow by providing a HUB descriptor with bNbPorts set to a value greater than UX_MAX_TT.
Which software versions are affected by CVE-2022-29223?
Versions prior to 6.1.10 of Microsoft Azure RTOS USBX are affected by CVE-2022-29223.
How can CVE-2022-29223 be fixed?
To fix CVE-2022-29223, it is recommended to update to version 6.1.10 or later of Microsoft Azure RTOS USBX.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/microsoft
- canonical/microsoft azure rtos usbx