USBX Host Heap Buffer Overflow via Malicious MTP/PTP Device

Executive Summary

This vulnerability involves a malicious USB MTP/PTP device exploiting a flaw in the USBX host software. During object enumeration, the device can over-report its object handle count, causing the host to read beyond the allocated receive buffer. This leads to reading adjacent heap contents or crashing due to unmapped memory access.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring USB MTP/PTP device interactions with the USBX host. Check if your system uses USBX versions prior to 6.5.2.202603. Inspect logs for crashes or heap corruption during USB device enumeration. No direct commands are provided, but enabling verbose USB logging and checking for buffer overflow errors may help.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause information disclosure by leaking heap memory contents to the application. It may also result in denial of service by crashing the system when accessing unmapped memory. Exploitation requires only attaching and enumerating the malicious device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to information disclosure by leaking adjacent heap contents to the application, which may expose sensitive data. This could violate GDPR's data protection principles and HIPAA's confidentiality requirements if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update USBX to version 6.5.2.202603 or later. Avoid connecting untrusted MTP/PTP USB devices. If updating is not possible, disable MTP/PTP functionality or restrict USB device access to trusted sources.

Useful 0 Not Useful 0