Usb Test
Monthly
Heap-based out-of-bounds write in USB Test 1.1.4 and earlier lets a rogue USB flash drive with crafted firmware corrupt the heap of the elevated Windows CLI process, crashing it and, per the vendor advisory, credibly opening a path to arbitrary code execution when a user starts a drive test. The utility trusts the DISK_GEOMETRY.BytesPerSector value returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking the call result or bounding the value, so a device reporting fewer than 8 bytes per sector under-sizes a heap buffer that then receives an 8-byte memcpy on every loop iteration; a reported value of 0 triggers a divide-by-zero and an enormous value causes std::bad_alloc. Exploitation requires a physically attached malicious device and a user who launches the tool, selects that drive and starts a test, which keeps the exposure narrow despite the vendor rating of 7.0; the vendor fix is version 1.1.5, and a public PoC reference exists (an in-source simulation of the untrusted value) but it is not verified as working exploit code.
Heap-based out-of-bounds write in USB Test 1.1.4 and earlier lets a rogue USB flash drive with crafted firmware corrupt the heap of the elevated Windows CLI process, crashing it and, per the vendor advisory, credibly opening a path to arbitrary code execution when a user starts a drive test. The utility trusts the DISK_GEOMETRY.BytesPerSector value returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking the call result or bounding the value, so a device reporting fewer than 8 bytes per sector under-sizes a heap buffer that then receives an 8-byte memcpy on every loop iteration; a reported value of 0 triggers a divide-by-zero and an enormous value causes std::bad_alloc. Exploitation requires a physically attached malicious device and a user who launches the tool, selects that drive and starts a test, which keeps the exposure narrow despite the vendor rating of 7.0; the vendor fix is version 1.1.5, and a public PoC reference exists (an in-source simulation of the untrusted value) but it is not verified as working exploit code.