Описание
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
A flaw was found in libusb. This out-of-bounds read vulnerability allows a local attacker, particularly in virtualized environments utilizing USB passthrough, to trigger a denial of service. By providing a malformed USB descriptor, the attacker can cause the software to read beyond its allocated memory, leading to system instability or crashes.
Отчет
This Moderate impact vulnerability in libusb allows a local attacker to cause a denial of service. Exploitation requires a virtualized environment with USB passthrough enabled, where a malicious guest can provide a specially crafted USB descriptor to the host, leading to an out-of-bounds read and system instability.
Меры по смягчению последствий
To reduce the risk associated with this vulnerability, restrict the use of USB passthrough in virtualized environments. Administrators should ensure that only trusted USB devices are allowed to be passed through to virtual machines. Disabling USB passthrough when not strictly necessary can prevent a local attacker from exploiting this flaw to cause a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libusb1 | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libusb | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libusb1 | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libusb | Out of support scope | ||
| Red Hat Enterprise Linux 8 | libusb | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libusb | Fix deferred | ||
| Red Hat Hardened Images | libusb1-main-1.0.30-1.hum1 | Fixed | RHSA-2026:20075 | 21.05.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
libusb before version 1.0.30 contains a one-byte out-of-bounds read vu ...
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
EPSS
5.5 Medium
CVSS3