CVE-2022-39293 Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflow
An integer underflow in Azure RTOS USBX PIMA host class allows attackers to trigger a buffer overflow, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39293?
CVE-2022-39293 is a high-severity vulnerability in azure-rtos usbx, published on 13 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in [_ux_host_class_pima_read](https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_pima_read.c), there is data length from device response, returned in the very first packet, and read by [L165 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L165), as header_length. Then in [L178 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L178), there is a “if” branch, which check the expression of “(header_length - UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE) > data_length” where if header_length is smaller than UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE, calculation could overflow and then [L182 code](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L182) the calculation of data_length is also overflow, this way the later [while loop start from L192](https://github.com/azure-rtos/usbx/blob/082fd9db09a3669eca3358f10b8837a5c1635c0b/common/usbx_host_classes/src/ux_host_class_pima_read.c#L192) can move data_pointer to unexpected address and cause write buffer overflow. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). The following can be used as a workaround: Add check of `header_length`: 1. It must be greater than `UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE`. 1. It should be greater or equal to the current returned data length (`transfer_request -> ux_transfer_request_actual_length`).
Weakness: CWE-191
Which versions are affected by CVE-2022-39293?
It affects 1 product.
Products include Eclipse Threadx Usbx.
How do I fix CVE-2022-39293?
No fix has been published for CVE-2022-39293 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-39293 being exploited?
There is no known exploitation of CVE-2022-39293 in the wild and no public exploit code.
Other vulnerabilities in azure-rtos usbx
- CVE-2022-29246 Potential buffer overflow in function DFU upload in Azure RTOS USBX
- CVE-2022-36063 USBX Host CDC ECM integer underflow with buffer overflow
- CVE-2022-29223 Buffer overflow on HUB descriptor in Azure RTOS USBX
- CVE-2023-48695 Azure RTOS USBX Remote Code Execution Vulnerability
- CVE-2023-48694 Azure RTOS USBX Remote Code Execution Vulnerability
Sources
Also known as GHSA-gg76-h537-xq48.