PT-2022-24914 · Microsoft · Azure Rtos Usbx

Published 2022-11-04 · Updated 2022-11-07 · CVE-2022-39344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions prior to 6.1.12

Description The USB DFU UPLOAD functionality in Azure RTOS USBX may be utilized to introduce a buffer overflow, resulting in the overwrite of memory contents. In particular cases, this may allow an attacker to bypass security features or execute arbitrary code. The implementation of the ux device class dfu control request function prevents buffer overflow during handling of the DFU UPLOAD command when the current state is UX SYSTEM DFU STATE DFU IDLE.

Recommendations For versions prior to 6.1.12, upgrade to version 6.1.12 to resolve the issue. As a temporary workaround, consider adding the UPLOAD LENGTH check in all possible states to prevent buffer overflow.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-39344

GHSA-M9P8-XRP7-VVQP

Affected Products

Azure Rtos Usbx

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39344.json · Exploit
• 🔥 https://github.com/azure-rtos/usbx/security/advisories/GHSA-m9p8-xrp7-vvqp · Exploit
• https://osv.dev/vulnerability/CVE-2022-39344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39344 · Security Note
• https://t.me/cibsecurity/52572 · Telegram Post
• https://t.me/cvenotify/37086 · Telegram Post