Mcuxsdk Middleware Usb
Monthly
Heap-based buffer overflow in NXP MCUXpresso SDK USB middleware before 2.13.0 lets a malicious USB device exploit unvalidated bNumEndpoints and bLength descriptor fields in the host audio, video, and CDC class drivers, writing past the fixed-size endpoint list and corrupting heap memory. The affected component must run as a USB host with one of those class drivers active, and the attack requires physical attachment of the crafted device (CVSS 4.0 AV:P); no remote path is described. Successful exploitation can lead to code execution or denial of service, but no public exploit was identified at time of analysis and KEV status is not indicated.
Out-of-bounds read in NXP's MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 allows a malicious USB host to disclose device memory by sending RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range informationBufferOffset. The CDC RNDIS device-class handler USB_DeviceCdcRndisSetCommand() validated informationBufferLength but trusted the host-supplied offset, so the read can run beyond the fixed command buffer. Exploitation requires physical USB access to an affected MCU that exposes the RNDIS function to an untrusted host; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap-based buffer overflow in NXP MCUXpresso SDK USB middleware before 2.13.0 lets a malicious USB device exploit unvalidated bNumEndpoints and bLength descriptor fields in the host audio, video, and CDC class drivers, writing past the fixed-size endpoint list and corrupting heap memory. The affected component must run as a USB host with one of those class drivers active, and the attack requires physical attachment of the crafted device (CVSS 4.0 AV:P); no remote path is described. Successful exploitation can lead to code execution or denial of service, but no public exploit was identified at time of analysis and KEV status is not indicated.
Out-of-bounds read in NXP's MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 allows a malicious USB host to disclose device memory by sending RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range informationBufferOffset. The CDC RNDIS device-class handler USB_DeviceCdcRndisSetCommand() validated informationBufferLength but trusted the host-supplied offset, so the read can run beyond the fixed command buffer. Exploitation requires physical USB access to an affected MCU that exposes the RNDIS function to an untrusted host; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.