Description

The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that the buf net_buf pointer is non-NULL. The handler is reached over the USB control endpoint, driven by the USB host. For a DFU_DNLOAD (download) request with no Data OUT stage — notably the zero-length terminating download that the DFU protocol uses to end a firmware transfer — the USB core invokes the class handler with a NULL buffer. After the device has been advanced to the DFU_DNLOAD_IDLE state (by sending one valid download block and a GET_STATUS), a zero-length DFU_DNLOAD reaches handle_download() with buf == NULL, dereferencing it. The result is a NULL+offset read that triggers a fatal CPU fault, i.e. a denial of service (device crash/reset). The attacker is whatever controls the USB host the device is attached to; DFU download support must be enabled with a registered image. There is no memory corruption or information disclosure — impact is limited to availability. The fix adds an explicit if (buf != NULL) guard so the callback receives a zero-length, NULL-data transfer instead of crashing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-11T06:17:12.620Z",
  "pubdate": "2026-08-11T06:17:12.620Z",
  "executiveSummary": "A vulnerability exists within the USB DFU class implementation of the experimental device_next USB device stack in Zephyr, specifically a NULL pointer dereference in the handle_download function located at subsys/usb/device_next/class/usbd_dfu.c.\nThe vulnerability leads to a denial of service, causing a fatal CPU fault and subsequent device crash or reset when triggered.\nThe flaw affects the Zephyr RTOS utilizing the new device_next USB device stack with DFU download support enabled and a registered image.\nAn attacker who controls the USB host connected to the target device can exploit this vulnerability.\nExploitation requires physical or logical access to the USB port where the device is attached and relies on sending specific control requests according to the USB DFU protocol.\nThere is no memory corruption or information disclosure associated with this issue; the impact is strictly limited to system availability.",
  "technicalDetails": "The root cause of the vulnerability is the lack of a validation check for a NULL pointer on the net_buf structure before its data is accessed within the handle_download function.\nThe vulnerable component is the USB DFU class handler in subsys/usb/device_next/class/usbd_dfu.c within Zephyr's experimental device_next USB device stack.\nDuring a DFU_DNLOAD request with no Data OUT stage, such as the zero-length terminating download mandated by the DFU protocol to conclude a firmware transfer, the USB core invokes the class handler with a NULL buffer.\nThe attack flow proceeds as follows: first, the device is advanced to the DFU_DNLOAD_IDLE state by transmitting a valid download block followed by a GET_STATUS request. Subsequently, the attacker sends a zero-length DFU_DNLOAD request from the controlling USB host.\nThis zero-length request reaches handle_download where the handler computes MIN(setup->wLength, buf->len) and attempts to pass buf->data directly to the image write callback without verifying that the buf net_buf pointer is non-NULL.\nBecause buf is NULL during zero-length transfers lacking an OUT stage, attempting to access its members results in a NULL+offset read that triggers a fatal CPU fault.\nAuthentication or privilege requirements are dictated by physical or logical USB connectivity; no software-level credentials are required as the interaction occurs over the USB control endpoint driven by the USB host.\nNetwork exposure is absent since the attack surface is strictly limited to the local USB interface.\nThe resulting payload behavior is an immediate device crash or reset, fulfilling a denial-of-service condition without post-exploitation persistence or lateral movement capabilities."
}