Tinyusb
Monthly
An out-of-bounds write in TinyUSB's MTP device class helper mtp_container_get_string() (src/class/mtp/mtp.h) lets a malicious USB host corrupt adjacent memory on the device by supplying a crafted MTP string with an unchecked character count, with the resulting memory corruption potentially leading to code execution or a denial of service. Only firmware built through TinyUSB 0.21.0 that implements and exposes the MTP device class is affected, and because the attacker must control or substitute the USB host the device is attached to, exploitation requires physical USB access, though once that connection exists no authentication or user interaction is needed. The flaw is rated 7.0 (CVSS 4.0, full confidentiality/integrity/availability impact on the device), is fixed upstream by commit e85c2b8 with a vendor patch available, and is prioritized for remediation this week; no CISA KEV entry and no public exploit were identified at time of analysis.
Integer underflow in TinyUSB's HID host report descriptor parser (tuh_hid_parse_report_descriptor()) allows a malicious USB device to trigger out-of-bounds reads and host denial of service by presenting a truncated report descriptor that makes the uint16_t remaining-length value wrap. TinyUSB releases before 0.20.1 used as a USB HID host are affected; exploitation requires physical attachment of a crafted device (AV:P), needs no authentication or user interaction, and is not reachable over a network. A vendor patch is available, and no public exploit was identified at time of analysis.
An out-of-bounds write in TinyUSB's MTP device class helper mtp_container_get_string() (src/class/mtp/mtp.h) lets a malicious USB host corrupt adjacent memory on the device by supplying a crafted MTP string with an unchecked character count, with the resulting memory corruption potentially leading to code execution or a denial of service. Only firmware built through TinyUSB 0.21.0 that implements and exposes the MTP device class is affected, and because the attacker must control or substitute the USB host the device is attached to, exploitation requires physical USB access, though once that connection exists no authentication or user interaction is needed. The flaw is rated 7.0 (CVSS 4.0, full confidentiality/integrity/availability impact on the device), is fixed upstream by commit e85c2b8 with a vendor patch available, and is prioritized for remediation this week; no CISA KEV entry and no public exploit were identified at time of analysis.
Integer underflow in TinyUSB's HID host report descriptor parser (tuh_hid_parse_report_descriptor()) allows a malicious USB device to trigger out-of-bounds reads and host denial of service by presenting a truncated report descriptor that makes the uint16_t remaining-length value wrap. TinyUSB releases before 0.20.1 used as a USB HID host are affected; exploitation requires physical attachment of a crafted device (AV:P), needs no authentication or user interaction, and is not reachable over a network. A vendor patch is available, and no public exploit was identified at time of analysis.