CVE-2025-55100: Eclipse ThreadX USBX Buffer Overflow Flaw

CVE-2025-55100 Overview

CVE-2025-55100 is an out-of-bounds read vulnerability affecting Eclipse Foundation's USBX module, the USB support component for ThreadX real-time operating system. The vulnerability exists in the _ux_host_class_audio10_sam_parse_func() function, which improperly handles boundary checking when parsing a list of sampling frequencies from USB audio devices. An attacker with physical access to a vulnerable device could potentially exploit this flaw to read memory beyond intended boundaries, leading to information disclosure.

Critical Impact

Physical access exploitation could allow attackers to read sensitive memory contents from embedded devices running ThreadX USBX, potentially exposing configuration data, cryptographic material, or other sensitive information stored in adjacent memory regions.

Affected Products

• Eclipse ThreadX USBX versions prior to 6.4.3

Discovery Timeline

• 2025-10-17 - CVE CVE-2025-55100 published to NVD
• 2025-10-23 - Last updated in NVD database

Technical Details for CVE-2025-55100

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when the application reads data past the end or before the beginning of the intended buffer. In the context of USBX, the _ux_host_class_audio10_sam_parse_func() function fails to properly validate the bounds of the sampling frequency list before parsing, allowing read operations to access memory beyond the allocated buffer.

The physical attack vector requires an adversary to connect a maliciously crafted USB audio device to the target system. When the USBX host driver attempts to enumerate and parse the audio device's sampling frequency descriptors, the vulnerable parsing function can be tricked into reading beyond the expected data boundaries.

Root Cause

The root cause lies in insufficient input validation within the audio class parsing function. When processing USB audio 1.0 sampling frequency descriptors, the function does not adequately verify that the number of sampling frequencies specified in the descriptor matches the actual data length available. This allows a specially crafted USB descriptor to cause the parser to read memory contents beyond the legitimate descriptor data.

Attack Vector

The attack requires physical access to connect a malicious USB device to the target embedded system. The attacker must craft a USB audio device descriptor with a sampling frequency count that exceeds the actual data provided, causing the vulnerable function to perform out-of-bounds memory reads during enumeration.

The exploitation scenario involves:

1. Attacker creates a malicious USB audio device with crafted descriptors
2. Attacker physically connects the device to a system running vulnerable USBX
3. USBX host stack enumerates the device and calls _ux_host_class_audio10_sam_parse_func()
4. The function reads beyond buffer boundaries based on the falsified frequency count
5. Information from adjacent memory regions may be exposed through device responses or timing analysis

Detection Methods for CVE-2025-55100

Indicators of Compromise

• Unexpected USB device enumeration failures or crashes in embedded systems
• System instability when connecting USB audio devices
• Unusual memory access patterns in ThreadX USBX debug logs
• Unexplained data in USB communication traces during device enumeration

Detection Strategies

• Monitor for abnormal USB device connection events, particularly audio class devices with unusual descriptors
• Implement memory access monitoring or memory protection units (MPU) to detect out-of-bounds read attempts
• Review USB enumeration logs for devices with suspicious or malformed audio descriptors
• Deploy endpoint detection solutions capable of monitoring USB stack behavior on embedded systems

Monitoring Recommendations

• Enable detailed logging for USB device enumeration events
• Configure hardware watchdog and MPU alerts for memory access violations
• Audit physical access to embedded devices running vulnerable USBX versions
• Implement USB device whitelisting where operationally feasible

How to Mitigate CVE-2025-55100

Immediate Actions Required

• Upgrade Eclipse ThreadX USBX to version 6.4.3 or later immediately
• Restrict physical access to embedded devices running vulnerable USBX versions
• Disable USB audio class support if not required for device operation
• Implement USB device filtering to block unknown or unauthorized audio devices

Patch Information

Eclipse Foundation has addressed this vulnerability in USBX version 6.4.3. Organizations should update their ThreadX USBX installations to this version or later. The security advisory with complete details is available through the GitHub Security Advisory.

Workarounds

• Disable USB audio class enumeration in USBX configuration if audio functionality is not required
• Implement physical security controls to prevent unauthorized USB device connections
• Deploy hardware-based USB device authentication where supported
• Configure USBX to only enumerate trusted/known USB devices through VID/PID filtering