Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The function PeiUsbGetAllConfiguration parses USB configuration descriptors from a physically connected USB device (EXTERNAL_UNTRUSTED) and uses two fields from the untrusted descriptor as array indices into fixed-size arrays in the page-allocated PEI_USB_DEVICE structure without proper runtime bounds validation.
The DXE-phase function UsbSelectConfig loops (line 412) on the untrusted NumInterfaces field from the USB configuration descriptor and writes a pointer to each newly created USB_INTERFACE into the fixed-size array Device->Interfaces[USB_MAX_INTERFACE] (16 entries, UsbBus.h:45,178) at line 431.
// No embargoed advisories.