GHSA-9pxv-6992-2g24: NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations

usbhdeviceinit() in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbhdevicesetconfiguration() — the only place udev->cfgdesc is allocated. The device structure is zero-initialised by usbhdevicealloc(), so udev->cfgdesc remains NULL.

usbhdeviceconnect() treats the zero return as a successful enumeration and calls usbhclassprobedevice(), which starts its descriptor walk from udev->cfgdesc. usbhdescgetnextfunction() passes that NULL pointer to usbhdescisvalid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer.

The condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHCEVTDEVCONNECTEDFS/HS event handler in subsys/usb/host/usbhcore.c, with no authentication and no user interaction beyond the physical attachment.

On targets where page zero is unmapped or CONFIGNULLPOINTEREXCEPTIONDETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfgdesc in usbhdescgetiface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIGUSBHOSTSTACK is marked experimental.