{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-36063", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2024-08-03T09:52:00.523Z", "dateReserved": "2022-07-15T00:00:00", "datePublished": "2022-10-10T00:00:00"}, "containers": {"cna": {"title": "USBX Host CDC ECM integer underflow with buffer overflow", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-10-10T00:00:00"}, "descriptions": [{"lang": "en", "value": "Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX\u2013supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integer underflow and a buffer overflow in the `_ux_host_class_cdc_ecm_mac_address_get` function which may be potentially exploited to achieve remote code execution or denial of service. Setting mac address string descriptor length to a `0` or `1` allows an attacker to introduce an integer underflow followed (string_length) by a buffer overflow of the `cdc_ecm -> ux_host_class_cdc_ecm_node_id` array. This may allow one to redirect the code execution flow or introduce a denial of service. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). Improved mac address string descriptor length validation to check for unexpectedly small values may be used as a workaround."}], "affected": [{"vendor": "azure-rtos", "product": "usbx", "versions": [{"version": "< 6.1.12", "status": "affected"}]}], "references": [{"url": "https://github.com/azure-rtos/usbx/security/advisories/GHSA-chpp-5fv9-6368"}, {"url": "https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_cdc_ecm_mac_address_get.c#L264"}, {"url": "https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "cweId": "CWE-121"}]}, {"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-191: Integer Underflow (Wrap or Wraparound)", "cweId": "CWE-191"}]}], "source": {"advisory": "GHSA-chpp-5fv9-6368", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:52:00.523Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/azure-rtos/usbx/security/advisories/GHSA-chpp-5fv9-6368", "tags": ["x_transferred"]}, {"url": "https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_cdc_ecm_mac_address_get.c#L264", "tags": ["x_transferred"]}, {"url": "https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:azure_rtos_usbx:*:*:*:*:*:*:*:*", "matchCriteriaId": "930D9474-0A8D-423B-AE4C-0E719ED5F6A2", "versionEndExcluding": "6.1.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX\u2013supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integer underflow and a buffer overflow in the `_ux_host_class_cdc_ecm_mac_address_get` function which may be potentially exploited to achieve remote code execution or denial of service. Setting mac address string descriptor length to a `0` or `1` allows an attacker to introduce an integer underflow followed (string_length) by a buffer overflow of the `cdc_ecm -> ux_host_class_cdc_ecm_node_id` array. This may allow one to redirect the code execution flow or introduce a denial of service. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). Improved mac address string descriptor length validation to check for unexpectedly small values may be used as a workaround."}, {"lang": "es", "value": "Azure RTOS USBx es una pila embebida de host, dispositivo y on-the-go (OTG) USB, totalmente integrada con Azure RTOS ThreadX y disponible para todos los procesadores compatibles con Azure RTOS ThreadX. La implementaci\u00f3n de Azure RTOS USBX del soporte de host para USB CDC ECM incluye un desbordamiento de entero y un desbordamiento de b\u00fafer en la funci\u00f3n \"_ux_host_class_cdc_ecm_mac_address_get\" que puede ser potencialmente explotada para lograr la ejecuci\u00f3n remota de c\u00f3digo o la denegaci\u00f3n de servicio. Establecer la longitud del descriptor de la cadena de direcciones mac a un \"0\" o \"1\" permite a un atacante introducir un desbordamiento de enteros seguido (string_length) por un desbordamiento del buffer del array \"cdc_ecm -) ux_host_class_cdc_ecm_node_id\". Esto puede permitir redirigir el flujo de ejecuci\u00f3n del c\u00f3digo o introducir una denegaci\u00f3n de servicio. La correcci\u00f3n ha sido incluida en USBX versi\u00f3n [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). Ha sido mejorada la comprobaci\u00f3n de la longitud del descriptor de la cadena de direcciones mac para comprobar los valores inesperadamente peque\u00f1os, lo que puede usarse como mitigaci\u00f3n"}], "id": "CVE-2022-36063", "lastModified": "2024-11-21T07:12:17.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-10T21:15:11.213", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_cdc_ecm_mac_address_get.c#L264"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/azure-rtos/usbx/security/advisories/GHSA-chpp-5fv9-6368"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_cdc_ecm_mac_address_get.c#L264"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/azure-rtos/usbx/security/advisories/GHSA-chpp-5fv9-6368"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-191"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1284"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}