CVE-2022-36063 : Security Advisory and Response

Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, integrated with Azure RTOS ThreadX. The CVE-2022-36063 involves an integer underflow and a buffer overflow in the

_ux_host_class_cdc_ecm_mac_address_get

function, potentially leading to remote code execution or denial of service.

Understanding CVE-2022-36063

This vulnerability affects Azure RTOS USBx versions prior to 6.1.12, allowing an attacker to exploit the USB CDC ECM implementation.

What is CVE-2022-36063?

The CVE-2022-36063 vulnerability in Azure RTOS USBx involves an integer underflow and a buffer overflow that can be exploited to achieve remote code execution or denial of service.

The Impact of CVE-2022-36063

The impact of CVE-2022-36063 includes the potential for an attacker to redirect code execution flow or introduce a denial of service.

Technical Details of CVE-2022-36063

This section provides insights into the vulnerability description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability is associated with an integer underflow and a buffer overflow in the

_ux_host_class_cdc_ecm_mac_address_get

function within the Azure RTOS USBx implementation.

Affected Systems and Versions

Azure RTOS USBx versions prior to 6.1.12 are affected by this vulnerability.

Exploitation Mechanism

By setting the mac address string descriptor length to a

0

or

1

, an attacker can trigger an integer underflow followed by a buffer overflow in the

cdc_ecm -> ux_host_class_cdc_ecm_node_id

array.

Mitigation and Prevention

To prevent exploitation of CVE-2022-36063, immediate steps such as updating to USBX release 6.1.12 are essential.

Immediate Steps to Take

Update to USBX release 6.1.12 or implement improved mac address string descriptor length validation to mitigate the vulnerability.

Long-Term Security Practices

Employ robust security practices, including regular software updates and code reviews, to enhance system security.

Patching and Updates

Ensure prompt implementation of security patches and updates to safeguard against potential exploits.