EDK II - NULL Pointer Dereference in XhcInitializeDeviceSlot64

Executive Summary

The 64-bit counterpart of XhcInitializeDeviceSlot. Three unchecked allocations: (1) InputContext at line 2472 with ASSERT-only, then ZeroMem at 2475; (2) EndpointTransferRing at line 2533 with NO NULL CHECK AT ALL, passed to CreateTransferRing at 2535; (3) OutputContext at line 2575 with ASSERT-only, then ZeroMem at 2578.

This advisory is one of a set reported to VulnCheck on 2026-06-25 for coordinated disclosure to the EDK II maintainers. After several follow-ups over the following months no response was received. 126 days after the initial report, ByteRay is publishing the findings in good faith so that affected integrators can assess and remediate them. All findings were identified against EDK II commit 70741a15d9a714323a5598eac47727e60507e22f (master, 2026-06-21).

Affected Products and Versions

• Vendor: TianoCore
• Product: EDK II (MdeModulePkg)
• Affected commit: 70741a15d9a714323a5598eac47727e60507e22f (master, 2026-06-21). The code is present on that commit and later revisions that have not changed it.
• Location: MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c:2472
• Function: XhcInitializeDeviceSlot64
• Category: error_handling

Technical Details

Controllability: SEMI_TRUSTED — confidence: high. Physical USB device triggers enumeration in 64-bit context mode, but cannot cause the allocations to fail: all three sizes are fixed (sizeof (INPUT_CONTEXT_64), sizeof (TRANSFER_RING), sizeof (DEVICE_CONTEXT_64)), so the dereference needs an unrelated memory exhaustion.

Data Flow

XhcPollPortStatusChange at line 1842 detects USB connect (64-bit CsZ==1). At line 2472, InputContext = UsbHcAllocateMem(...) with ASSERT-only at 2473, then ZeroMem at 2475. At line 2533, EndpointTransferRing = AllocateZeroPool(...) with NO CHECK AT ALL. At line 2575, OutputContext = UsbHcAllocateMem(...) with ASSERT-only at 2576, then ZeroMem at 2578.

Affected Callers

• XhcPollPortStatusChange

Sanitization / Security Controls

• DEBUG-only ASSERT (partial — only at lines 2473 and 2576; line 2533 has no check at all).

Reachability and Preconditions

Attacker position and trust level for this issue are stated in the Controllability line and Data Flow above, and the concrete trigger is in Reproduction below.

Exploitability: Low
Realism: Low

Reproduction

1. Physical access to USB port; 64-bit XHCI controller; RELEASE build; memory pressure.
2. Attacker connects any USB device while pool memory is exhausted.
3. XhcPollPortStatusChange detects the USB connect and calls XhcInitializeDeviceSlot64.
4. At line 2472, UsbHcAllocateMem for InputContext returns NULL; ASSERT at 2473 is no-op; ZeroMem at 2475 dereferences NULL.
5. At line 2533, AllocateZeroPool for EndpointTransferRing returns NULL with NO CHECK; CreateTransferRing at 2535 writes through NULL (TransferRing->RingSeg0 at line 913).

Impact

Denial of service — firmware crash during USB enumeration.

Remediation and Mitigation

As of commit 70741a15d9a714323a5598eac47727e60507e22f this issue is unfixed upstream and no CVE has been assigned. Check the allocation result for NULL before dereferencing it and fail the operation cleanly when allocation fails. The specific control that is absent or ineffective is identified in the Sanitization / Security Controls list under Technical Details.

Timeline

• 2026-06-25 - Reported to VulnCheck for coordinated disclosure to the TianoCore / EDK II security team.
• 2026-07 to 2026-10 - Several follow-ups sent; no response received.
• 2026-10-29 - Public disclosure in good faith, 126 days after the initial report.

Credits

Discovered and reported by Argus-Systems.

References

• EDK II source (TianoCore)
• Affected file at the referenced commit