VYPR
← All advisories
Unrated severityNVD Advisory· Published May 11, 2020· Updated Sep 17, 2024

Buffer Overflow in USB DFU requested length

CVE-2020-10019

Description

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.

Affected products

1

Patches

3
afb307d3ff99

usb: dfu: check requested length (wLength) during DFU_UPLOAD

https://github.com/zephyrproject-rtos/zephyrJohann FischerMar 2, 2020via osv
commitPR #23460
1 file changed · +9 −0
  • subsys/usb/class/usb_dfu.c+9 −0 modified
    @@ -515,6 +515,15 @@ static int dfu_class_handle_req(struct usb_setup_packet *pSetup,
 				len = pSetup->wLength;
 			}
 
+			if (len > USB_DFU_MAX_XFER_SIZE) {
+				/*
+				 * The host could requests more data as stated
+				 * in wTransferSize. Limit upload length to the
+				 * size of the request-buffer.
+				 */
+				len = USB_DFU_MAX_XFER_SIZE;
+			}
+
 			if (len) {
 				const struct flash_area *fa;
8289dc75dda5

usb: dfu: check requested length (wLength) during DFU_UPLOAD

https://github.com/zephyrproject-rtos/zephyrJohann FischerMar 2, 2020via osv
commitPR #23457
1 file changed · +9 −0
  • subsys/usb/class/usb_dfu.c+9 −0 modified
    @@ -509,6 +509,15 @@ static int dfu_class_handle_req(struct usb_setup_packet *pSetup,
 				len = pSetup->wLength;
 			}
 
+			if (len > USB_DFU_MAX_XFER_SIZE) {
+				/*
+				 * The host could requests more data as stated
+				 * in wTransferSize. Limit upload length to the
+				 * size of the request-buffer.
+				 */
+				len = USB_DFU_MAX_XFER_SIZE;
+			}
+
 			if (len) {
 				const struct flash_area *fa;
105849cf38bf

usb: dfu: check requested length (wLength) during DFU_UPLOAD

https://github.com/zephyrproject-rtos/zephyrJohann FischerMar 2, 2020via osv
commitPR #23190
1 file changed · +9 −0
  • subsys/usb/class/usb_dfu.c+9 −0 modified
    @@ -509,6 +509,15 @@ static int dfu_class_handle_req(struct usb_setup_packet *pSetup,
 				len = pSetup->wLength;
 			}
 
+			if (len > USB_DFU_MAX_XFER_SIZE) {
+				/*
+				 * The host could requests more data as stated
+				 * in wTransferSize. Limit upload length to the
+				 * size of the request-buffer.
+				 */
+				len = USB_DFU_MAX_XFER_SIZE;
+			}
+
 			if (len) {
 				const struct flash_area *fa;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.