Re: [Buildroot] [PATCH] package/libusb: security bump to version 1.0.30

[Julien Olivain via buildroot <buildroot@buildroot.org>]

On 05/06/2026 09:00, Peter Korsgaard wrote:
> Fixes the following security issues:
> 
> CVE-2026-23679: libusb before version 1.0.30 contains a NULL pointer
> dereference vulnerability that allows attackers to crash applications 
> by
> supplying a malformed USB configuration descriptor where an interface 
> claims
> bNumEndpoints greater than zero but is followed by a class-specific
> descriptor whose bLength exceeds the remaining buffer size, causing
> parse_interface() to return early without allocating the endpoint 
> array.
> Attackers can exploit this flaw through 
> libusb_get_active_config_descriptor
> or libusb_get_config_descriptor by providing crafted descriptors via
> virtualized USB passthrough, file-based descriptor parsing, or network
> sources, causing any application iterating over endpoints to 
> dereference a
> NULL endpoint pointer and crash.
> 
> https://nvd.nist.gov/vuln/detail/CVE-2026-23679
> 
> CVE-2026-47104: libusb before version 1.0.30 contains a one-byte
> out-of-bounds read vulnerability in parse_iad_array() in descriptor.c 
> that
> allows attackers to trigger a denial of service by supplying a 
> malformed USB
> descriptor whose bLength equals size minus one, causing the bounds 
> check to
> use the original buffer size instead of the remaining size.  Attackers 
> in
> virtualized environments with USB passthrough can supply crafted 
> descriptors
> through libusb_get_active_interface_association_descriptors or
> libusb_get_interface_association_descriptors to read one byte past the 
> end
> of the malloc allocation, resulting in a denial of service.
> 
> https://nvd.nist.gov/vuln/detail/CVE-2026-47104
> 
> For more details, see the announcement:
> https://sourceforge.net/p/libusb/mailman/message/59335553/
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot