CVE-2026-12052

{
  "id": "CVE-2026-12052",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T06:17:12.747",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.\n\nThe control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.\n\nThe request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler."
    },
    {
      "lang": "es",
      "value": "El gestor de control a host de la clase CDC NCM del lado del dispositivo USB usbd_cdc_ncm_cth en subsys/usb/device_next/class/usbd_cdc_ncm.c construye una respuesta de tamaño fijo para las solicitudes de clase GET_NTB_PARAMETERS (estructura ntb_parameters de 28 bytes) y GET_NTB_INPUT_SIZE (estructura ntb_input_size de 8 bytes) y copia la estructura completa en el búfer de control DATA IN con net_buf_add_mem(buf, ..., sizeof(...)), ignorando el wLength proporcionado por el host.\n\nEl búfer de control DATA IN es asignado por la pila USB con una capacidad de exactamente wLength bytes (usbd_ep_ctrl_data_in_alloc   ->   udc_ctrl_data_alloc   ->   net_buf_alloc_len(&udc_ep_pool, wLength); no se aplica redondeo para el punto final IN). Debido a que net_buf_add_mem/net_buf_simple_add solo limita la copia con un __ASSERT_NO_MSG, que se compila fuera en las compilaciones de producción, un host que emite una de estas solicitudes de control estándar de CDC NCM con un wLength menor que la estructura de respuesta (por ejemplo, wLength = 1) hace que el gestor copie con memcpy hasta 27 bytes más allá del final del búfer de pool asignado.\n\nLos campos de la solicitud provienen directamente del paquete USB SETUP, por lo que cualquier host (o interponedor USB) contra el que el dispositivo Zephyr se enumere puede activar el desbordamiento sin autenticación una vez que se conecta una imagen construida con la pila USB device_next y la clase CDC NCM. La escritura fuera de límites corrompe las asignaciones adyacentes y los metadatos en el udc_ep_pool compartido, causando principalmente corrupción de memoria y denegación de servicio de la pila USB; la longitud del desbordamiento está limitada (menor o igual que 27 bytes) y el contenido escrito son constantes de dispositivo fijas, y el error no lee nada de vuelta, por lo que no hay revelación de información. La solución limita la copia con MIN(sizeof(...), setup  ->  wLength), coincidiendo con el gestor CDC ACM existente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/usb/device_next/class/usbd_cdc_ncm.c"
          ],
          "versions": [
            {
              "version": "4.0.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T17:01:33.666847Z",
          "id": "CVE-2026-12052",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vr4p-6rg5-qgpx",
      "source": "[email protected]"
    }
  ]
}