CVE-2025-55095: High severity Eclipse Threadx Usbx vulnerability
The function uxhostclassstoragemediamount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition.
This recursion occurs in uxhostclassstoragepartitionread(), which parses up to four partition entries. If an extended partition is found (with type UXHOSTCLASSSTORAGEPARTITIONEXTENDED or EXTENDEDLBAMAPPED), the code invokes: uxhostclassstoragemediamount(storage, sector + uxutilitylongget(...));
There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Eclipse ThreadX USBX that mount USB mass-storage media are exposed when they process a malicious or malformed disk image containing extended partition entries.
What does an attacker need to exploit it?
An attacker needs a USB mass-storage device or disk image that the affected system will mount. The partition table must contain cyclic or excessively deep chains of extended partitions.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required, consistent with a user or system action that causes the malicious storage media to be mounted.
What happens if exploitation succeeds?
The recursive partition-mounting logic can continue until stack overflow occurs. The reported impact includes low confidentiality, integrity, and availability impact.