Hello, My name is Brian Lee, and I am a PhD Security Researcher in SSLab at Georgia Tech. I'd like to privately report a potential security bug in u-boot where U-Boot USB configuration parsing retains unvalidated interface and endpoint counts, which usb_set_maxpacket() later uses to walk beyond fixed descriptor arrays. We found the same pattern in 2 different nesting level.
Target: * Project: u-boot * Repo: https://github.com/u-boot/u-boot * Pinned ref: 3cdce049f90d77c3f9221f1eb73922384c8972c3 Bug 1: A physically present attacker plugs in a malicious USB peripheral that answers U-Boot's standard GET_DESCRIPTOR requests. The device returns a valid device descriptor and then a minimal configuration descriptor with wTotalLength=9 and bNumInterfaces=255 but no interface descriptors. U-Boot copies the advertised interface count, records zero actually parsed interfaces, ignores the parser return value, and then walks dev->config.if_desc as if 255 interface records existed, producing an out-of-bounds read during bootloader enumeration before an OS or higher-level USB policy can intervene. Bug2: The attacker connects a malicious USB peripheral to the target board before or during boot. During normal U-Boot USB host enumeration, the device returns a valid configuration descriptor containing one interface that claims 255 endpoints while the descriptor body contains exactly 16 endpoint descriptors. U-Boot copies the interface descriptor, copies the 16 endpoint descriptors, then uses the unbounded claimed endpoint count to walk beyond the fixed endpoint array while setting max-packet state. Attached: When reporting by email, for better readability of the email and for those who prefer private channels when discussing security bugs, we share the full writeup and PoC files via zip file attachment. If you don't want to download an arbitrary zip file and use it, please let us know. The zip file contains: * README.md : full writeup. * poc : the relevant files and scripts for reproducing the PoC I would like to get help from your expertise to clarify whether this is a valid security threat or not. Thank you. Best Regards, Brian Lee
<<attachment: INT-usb-uboot-bnuminterfaces-oob.zip>>
<<attachment: INT-usb-uboot-endpoint-count-oob.zip>>
