CVE-2022-39293
- Source
- https://cve.org/CVERecord?id=CVE-2022-39293
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39293.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-39293
- Aliases
-
- GHSA-gg76-h537-xq48
- Published
- 2022-10-13T00:00:00Z
- Modified
- 2026-07-15T02:06:14.679149456Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
- Summary
- Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflow
- Details
-
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in uxhostclasspima_read, there is data length from device response, returned in the very first packet, and read by L165 code, as headerlength. Then in L178 code, there is a “if” branch, which check the expression of “(headerlength - UXHOSTCLASSPIMADATAHEADERSIZE) > datalength” where if headerlength is smaller than UXHOSTCLASSPIMADATAHEADERSIZE, calculation could overflow and then L182 code the calculation of datalength is also overflow, this way the later while loop start from L192 can move datapointer to unexpected address and cause write buffer overflow. The fix has been included in USBX release 6.1.12. The following can be used as a workaround: Add check of
header_length: 1. It must be greater thanUX_HOST_CLASS_PIMA_DATA_HEADER_SIZE. 1. It should be greater or equal to the current returned data length (transfer_request -> ux_transfer_request_actual_length). - Database specific
{ "cwe_ids": [ "CWE-191" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39293.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/eclipse-threadx/usbx
Affected ranges
- Type
- GIT
- Repo
- https://github.com/eclipse-threadx/usbx
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "cpe": "cpe:2.3:a:eclipse:threadx_usbx:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "6.1.12" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE", "REFERENCES" ] }