Executive brief
The Zephyr operating system's USB network device stack fails to validate response sizes for certain standard USB network requests, leading to a buffer overflow. A malicious USB host or interposer can trigger this by sending specially-crafted requests, causing the device to write data past the allocated buffer boundary. This results in memory corruption, denial of service, and potential loss of network connectivity on affected embedded devices.
Technical details
The vulnerability is a heap buffer overflow in the USB device-side CDC NCM class handler (usbd_cdc_ncm_cth) in Zephyr's device_next USB stack. The handler responds to GET_NTB_PARAMETERS (28 bytes) and GET_NTB_INPUT_SIZE (8 bytes) control requests by copying fixed-size structures into a response buffer allocated to exactly the host-supplied wLength size, ignoring the actual response size. The out-of-bounds write occurs because net_buf_add_mem boundary checks are compiled out in production builds. Any USB host or interposer can trigger this without authentication by sending these standard CDC NCM control requests with a wLength smaller than the response structure (e.g., wLength=1). The overflow writes up to 27 bytes of device constants into adjacent memory, causing heap corruption and USB stack denial of service. The vulnerability does not allow information disclosure or code execution due to the fixed content and bounded overflow length. The fix applies MIN(sizeof(...), setup->wLength) to clamp the copy size.
Affected products
- Zephyr Zephyr OS device_next USB stack with CDC NCM class
Timeline
- 2026-08-11: disclosed