EDK II - NULL Pointer Dereference in XhcPeiSetConfigCmd64

Executive Summary

The PEI-phase 64-bit counterpart of XhcInitializeEndpointContext64. Two EndpointTransferRing allocations at lines 2027 (BULK) and 2093 (INTERRUPT) have NO NULL CHECK AT ALL before being passed to XhcPeiCreateTransferRing.

This advisory is one of a set reported to VulnCheck on 2026-06-25 for coordinated disclosure to the EDK II maintainers. After several follow-ups over the following months no response was received. 126 days after the initial report, ByteRay is publishing the findings in good faith so that affected integrators can assess and remediate them. All findings were identified against EDK II commit 70741a15d9a714323a5598eac47727e60507e22f (master, 2026-06-21).

Affected Products and Versions

• Vendor: TianoCore
• Product: EDK II (MdeModulePkg)
• Affected commit: 70741a15d9a714323a5598eac47727e60507e22f (master, 2026-06-21). The code is present on that commit and later revisions that have not changed it.
• Location: MdeModulePkg/Bus/Pci/XhciPei/XhciSched.c:2027
• Function: XhcPeiSetConfigCmd64
• Category: error_handling

Technical Details

Controllability: SEMI_TRUSTED — confidence: high. Physical USB device triggers PEI-phase 64-bit configuration.

Data Flow

At line 2027 (64-bit BULK case), EndpointTransferRing = AllocateZeroPool(...) has NO CHECK. At line 2029, XhcPeiCreateTransferRing dereferences NULL when it writes the ring fields through the pointer (lines 2850-2854). Line 2093 (INTERRUPT case) follows the identical pattern. XhcPeiSetConfigCmd64 is reached from the SET_CONFIGURATION hook in XhcPeiControlTransfer (XhcPeim.c:756) when the controller uses 64-byte contexts (HcCParams.Data.Csz != 0). Each allocation is a fixed sizeof(TRANSFER_RING), so the device cannot force it to fail; the NULL return only happens under memory exhaustion.

Affected Callers

• XhcPeiControlTransfer (XhcPeim.c:756)

Sanitization / Security Controls

• None.

Reachability and Preconditions

Attacker position and trust level for this issue are stated in the Controllability line and Data Flow above, and the concrete trigger is in Reproduction below.

Exploitability: Low
Realism: Low

Reproduction

1. Physical access to USB port; PEI-phase boot; xHCI controller using 64-byte contexts (HcCParams.Data.Csz != 0); memory pressure.
2. Attacker connects physical USB device and triggers endpoint configuration during PEI-phase boot.
3. XhcPeiSetConfigCmd64 configures endpoints.
4. At line 2027 (64-bit BULK case), AllocateZeroPool for EndpointTransferRing returns NULL with NO CHECK.
5. At line 2029, XhcPeiCreateTransferRing dereferences NULL. Line 2093 (INTERRUPT case) follows the identical pattern.

Impact

Denial of service — firmware crash during PEI USB configuration.

Remediation and Mitigation

As of commit 70741a15d9a714323a5598eac47727e60507e22f this issue is unfixed upstream and no CVE has been assigned. Check the allocation result for NULL before dereferencing it and fail the operation cleanly when allocation fails. The specific control that is absent or ineffective is identified in the Sanitization / Security Controls list under Technical Details.

Timeline

• 2026-06-25 - Reported to VulnCheck for coordinated disclosure to the TianoCore / EDK II security team.
• 2026-07 to 2026-10 - Several follow-ups sent; no response received.
• 2026-10-29 - Public disclosure in good faith, 126 days after the initial report.

Credits

Discovered and reported by Argus-Systems.

References

• EDK II source (TianoCore)
• Affected file at the referenced commit