CVE-2022-39344
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
75.0%
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of ux_device_class_dfu_control_request function prevents buffer overflow during handling of DFU UPLOAD command when current state is UX_SYSTEM_DFU_STATE_DFU_IDLE. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the UPLOAD_LENGTH check in all possible states.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| microsoft:azure_rtos_usbx | microsoft azure rtos usbx | lt | 6.1.12 |
CNA Affected
[
{
"vendor": "azure-rtos",
"product": "usbx",
"versions": [
{
"version": "< 6.1.12",
"status": "affected"
}
]
}
]Social References
More
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
75.0%