Unknown
CVE-2022-39293
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2022-39293
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in _ux_host_class_pima_read, there is data length from device response, returned in the very first packet, and read by L165 code, as header_length. Then in L178 code, there is a “if” branch, which check the expression of “(header_length – UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE) > data_length” where if header_length is smaller than UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE, calculation could overflow and then L182 code the calculation of data_length is also overflow, this way the later while loop start from L192 can move data_pointer to unexpected address and cause write buffer overflow. The fix has been included in USBX release 6.1.12. The following can be used as a workaround: Add check of header_length: 1. It must be greater than UX_HOST_CLASS_PIMA_DATA_HEADER_SIZE. 1. It should be greater or equal to the current returned data length (transfer_request -> ux_transfer_request_actual_length).
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- azure rtos usbx
References
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
