PT-2022-19475 · Microsoft · Azure Rtos Usbx

Szymonh · Published 2022-05-24 · Updated 2025-10-27 · CVE-2022-29223

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions prior to 6.1.10

Description The issue arises when an attacker provides a HUB descriptor with bNbPorts set to a value greater than UX MAX TT, which defaults to 8, causing a buffer overflow in the Azure RTOS USBX host stack. Specifically, for a bNbPorts value of 255, the implementation of the ux host class hub descriptor get function modifies the contents of the hub -> ux host class hub device -> ux device hub tt array, violating the end boundary by 255 - UX MAX TT items. The USB host stack should validate the number of ports reported by the hub and reject the request if the value is larger than UX MAX TT.

Recommendations For versions prior to 6.1.10, update to USBX release 6.1.10 to resolve the issue. As a temporary workaround, consider configuring the USB host stack to validate and reject HUB descriptors with bNbPorts values greater than UX MAX TT.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-29223

GHSA-2QC5-385M-X862

Affected Products

Azure Rtos Usbx

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29223.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-29223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29223 · Security Note
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-2qc5-385m-x862 · Note
• https://github.com/azure-rtos/usbx/releases/tag/v6.1.10_rel · Note
• https://t.me/cibsecurity/43261 · Telegram Post
• https://t.me/cveNotify/140459 · Telegram Post