Eclipse USBX Out-of-Bounds Read Vulnerability in Audio Descriptor Parsing

A potential out-of-bounds read vulnerability has been identified in the USBX USB support module for Eclipse Foundation ThreadX, prior to version 6.4.3. The issue arises in the function '_ux_host_class_audio_alternate_setting_locate()' while parsing audio configuration descriptors. When the 'bSamFreqType' field indicates a range or list of frequencies, the function improperly reads additional bytes without verifying if enough data is available. This flaw could be exploited by a malicious USB device to craft a short descriptor that causes the host to read past its buffer, potentially leading to crashes or information leakage.

Impact

Exploitation of this vulnerability could cause crashes or unauthorized information disclosure.

Remediation

Users can upgrade to USBX version 6.4.3 or later to address this vulnerability.