Out-of-Bounds Write in TinyUSB MTP Device Class

Executive Summary

TinyUSB through 0.21.0 has an out-of-bounds write flaw in the MTP device class helper function mtp_container_get_string() in src/class/mtp/mtp.h. A malicious USB host can exploit this by sending a crafted MTP string with an unbounded character count, causing the function to corrupt adjacent memory via an unchecked memcpy operation that copies up to 510 bytes into a fixed-size buffer. This can lead to code execution or denial of service on the TinyUSB MTP device.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to TinyUSB devices and requires physical access to the USB host or device. Detection involves inspecting TinyUSB versions and checking for the presence of the vulnerable MTP device class. No direct network detection commands are applicable.

Useful 0 Not Useful 0

Impact Analysis

If you use a device running TinyUSB with MTP support, an attacker with physical access to the USB port could exploit this to execute arbitrary code on your device or crash it, potentially leading to data loss or unauthorized access. The impact depends on the device's role and data sensitivity.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade TinyUSB to a version containing commit e85c2b8 or later to patch the out-of-bounds write vulnerability.
• Disable MTP functionality on TinyUSB devices if not required, reducing attack surface.
• Restrict physical access to USB devices to prevent malicious host interactions.

Useful 0 Not Useful 0