PT-2022-11614 · Stmicroelectronics+2 · Stm32 Mw Usb Host+2

Defonceuse + 1 · Published 2022-10-21 · Updated 2025-05-07 · CVE-2021-42553

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions stm32 mw usb host versions prior to 3.5.1

Description A buffer overflow issue allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH MAX NUM ENDPOINTS. This typically occurs when using a RTOS such as FreeRTOS on STM32 MCUs.

Recommendations For versions prior to 3.5.1, update to version 3.5.1 or later to resolve the issue. As a temporary workaround, consider restricting the number of endpoints in the descriptor to prevent it from exceeding USBH MAX NUM ENDPOINTS.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-42553

USN-7472-1

Affected Products

Linuxmint

Ubuntu

Stm32 Mw Usb Host

References · 13

• https://github.com/STMicroelectronics/stm32_mw_usb_host/pull/4 · Patch
• https://osv.dev/vulnerability/CVE-2021-42553 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42553 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42553 · Security Note
• https://ubuntu.com/security/notices/USN-7472-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8946 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-42553 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-42553 · Security Note
• https://osv.dev/vulnerability/USN-7472-1 · Vendor Advisory
• https://github.com/STMicroelectronics/stm32_mw_usb_host · Note
• https://t.me/cibsecurity/51912 · Telegram Post
• https://t.me/cvenotify/121300 · Telegram Post