CVE-2025-55098 Overview
CVE-2025-55098 is an out-of-bounds read vulnerability in Eclipse Foundation ThreadX USBX, the USB support module for the ThreadX real-time operating system. The flaw resides in the _ux_host_class_audio_device_type_get() function, which parses descriptors from attached USB audio devices. A malformed descriptor can cause the parser to read memory outside the intended buffer. The issue affects USBX versions prior to 6.4.3 and is tracked under [CWE-125]. Exploitation requires physical access to attach a crafted USB audio device to the embedded target.
Critical Impact
An attacker with physical access to a device running vulnerable USBX firmware can trigger out-of-bounds memory reads by connecting a malicious USB audio device, potentially leaking limited data or disrupting USB host functionality.
Affected Products
- Eclipse Foundation ThreadX USBX versions before 6.4.3
- Embedded systems and IoT devices using ThreadX RTOS with the USBX host audio class driver
- Firmware images shipping the _ux_host_class_audio_device_type_get() parser
Discovery Timeline
- 2025-10-17 - CVE-2025-55098 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2025-55098
Vulnerability Analysis
The vulnerability sits in the USB host audio class driver included with ThreadX USBX. When the host enumerates an attached USB audio device, _ux_host_class_audio_device_type_get() walks through the configuration and interface descriptors returned by the device. The function trusts length fields and iterates descriptor structures without fully validating that each read stays within the allocated buffer. A device returning a truncated or malformed descriptor forces the parser to read memory beyond the descriptor buffer boundary. Because USBX runs on resource-constrained embedded targets, adjacent memory may contain sensitive runtime state used by other RTOS threads.
Root Cause
The root cause is insufficient bounds checking during descriptor traversal. The parser advances pointers using length values supplied by the device without verifying the resulting offset against the end of the descriptor buffer. This matches [CWE-125], Out-of-Bounds Read, where control over a length or index field causes a read past the end of a buffer.
Attack Vector
Exploitation requires physical access. An attacker must connect a USB device that advertises the audio class and presents a crafted descriptor to the embedded host. No authentication or user interaction beyond the USB attach event is required. The impact is limited to information disclosure and availability degradation of the USB stack. The parser cannot be reached remotely because the trigger occurs during device enumeration on a physical USB port.
No verified public exploit code is available. Technical details are published in the Eclipse ThreadX USBX GitHub Security Advisory GHSA-4jc2-x5hv-46fq.
Detection Methods for CVE-2025-55098
Indicators of Compromise
- Unexpected resets, crashes, or watchdog restarts on embedded devices coinciding with USB device insertion events
- USB audio devices connected to systems that do not normally interact with audio peripherals
- USBX stack errors or faults logged by the ThreadX kernel after enumeration of a new USB device
Detection Strategies
- Perform a software bill of materials (SBOM) review to identify firmware images bundling ThreadX USBX versions earlier than 6.4.3
- Instrument firmware builds with memory sanitizers during QA to catch out-of-bounds reads in _ux_host_class_audio_device_type_get() when fuzzing descriptors
- Review device logs for abnormal termination of USB host tasks during enumeration
Monitoring Recommendations
- Monitor physical access to deployed embedded devices and USB ports exposed on field equipment
- Correlate device uptime anomalies with USB insertion telemetry where available
- Track vendor advisories from the Eclipse Foundation for additional USBX fixes beyond 6.4.3
How to Mitigate CVE-2025-55098
Immediate Actions Required
- Upgrade Eclipse ThreadX USBX to version 6.4.3 or later and rebuild affected firmware images
- Inventory all embedded products and IoT devices that embed ThreadX USBX with the audio host class enabled
- Restrict physical access to USB ports on fielded devices until patched firmware is deployed
Patch Information
The fix is published in Eclipse ThreadX USBX 6.4.3. Refer to the Eclipse ThreadX USBX Security Advisory GHSA-4jc2-x5hv-46fq for commit details and upgrade guidance.
Workarounds
- Disable the USB host audio class driver in the USBX build configuration if audio device support is not required
- Apply physical port blockers or tamper-evident seals on USB connectors of production devices
- Limit device deployment to environments where untrusted USB peripherals cannot be attached
# Configuration example: exclude the host audio class from the USBX build
# Remove or comment out the audio class registration in your USBX host initialization
# ux_host_stack_class_register(_ux_system_host_class_audio_name, ux_host_class_audio_entry);
# Then rebuild firmware against USBX 6.4.3 or later
git clone https://github.com/eclipse-threadx/usbx.git
cd usbx
git checkout v6.4.3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
