Description

The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a full max-packet-size packet arrives but the buffer still has tailroom (the transfer is not yet complete), the pre-fix code both re-arms the endpoint to keep filling that same buf via work_handler_xfer_continue() and simultaneously hands the same, still-being-filled buffer to the upper stack with udc_submit_ep_event(). Because udc_submit_ep_event() transfers ownership of the buffer to the USB device stack (usbd_event_carrier() appends &buf->node to uds_ctx->ep_events, after which the class handler processes and net_buf_unref()s it), the driver continues to DMA subsequent host-controlled OUT packets into a buffer the upper stack may already have freed and recycled — a use-after-free write. In addition, since the buffer was never dequeued, the completing packet runs udc_buf_get() on the same object and submits it a second time, appending &buf->node to the event slist twice (singly-linked-list corruption) and causing a double net_buf_unref(). The IT82xx2 is a USB peripheral controller, so the untrusted USB host controls OUT-transfer packetization and can force this path against any non-control OUT endpoint whose queued buffer exceeds one packet — an ordinary bulk/interrupt pattern. The driver and USB device stack run in kernel context above the external host, giving the host a device-side kernel heap-corruption primitive: a reliable denial of service and, because the written bytes are attacker-controlled, plausible corruption of adjacent net_buf pool memory. The vector is physical (USB attach). The fix defers submission until the buffer is completely filled and lets xfer_work_handler() drive continuation, so each OUT buffer is submitted to the upper stack exactly once.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-14T20:16:39.207Z",
  "pubdate": "2026-09-14T20:16:39.207Z",
  "executiveSummary": "The ITE IT82xx2 USB device-controller driver is susceptible to a critical use-after-free vulnerability and linked-list corruption during multi-packet OUT transfers.\nThe vulnerability stems from improper buffer management within work_handler_out() in drivers/usb/udc/udc_it82xx2.c, where the driver prematurely surfaces a buffer to the upper USB stack while continuing to DMA subsequent packets into that same memory region.\nAn untrusted USB host can trigger this condition by controlling the packetization of bulk/interrupt transfers, granting the attacker a device-side kernel heap corruption primitive.\nThe impact includes reliable denial of service, memory corruption within the net_buf pool, and potential code execution through the manipulation of recycled memory structures.\nExploitation requires physical access via a USB connection to a device running the affected IT82xx2 driver, making it a high-risk vector for embedded systems and peripherals.\nSuccessful exploitation allows an attacker to overwrite arbitrary kernel heap data by controlling the contents of the DMA-driven USB transfers.",
  "technicalDetails": "The vulnerability resides in the work_handler_out() function of the IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c). The root cause is a race condition between DMA hardware operations and the USB stack notification logic for multi-packet OUT transfers.\nWhen the controller receives a full max-packet-size packet that does not fully satisfy the active transfer buffer, the driver logic incorrectly proceeds to invoke udc_submit_ep_event() while simultaneously re-arming the endpoint via work_handler_xfer_continue().\nBecause udc_buf_peek() is used to obtain the buffer without dequeuing it, the driver maintains a stale reference to the buffer. Simultaneously, udc_submit_ep_event() passes ownership of the buffer to the USB device stack, leading to an eventual net_buf_unref() call that marks the memory as free/recycled.\nThe driver continues to DMA data from the host into this recycled memory area, resulting in a use-after-free write (write-what-where primitive). Furthermore, since the buffer was never dequeued, the final packet completion triggers a second udc_buf_get() operation for the same object.\nThis secondary trigger causes the same buffer node to be appended to the uds_ctx->ep_events singly-linked-list twice, leading to structure corruption and double net_buf_unref() calls. This double-free state further destabilizes the kernel heap manager.\nThe attack flow is initiated by a malicious USB host that sends segmented bulk/interrupt OUT transfers designed to fill only a portion of the driver's pre-allocated buffer per packet. By manipulating the packet sizes, the host forces the driver to reach the vulnerable code path where it surfaces the buffer to the upper stack while retaining DMA access to it.\nThe payload consists of attacker-supplied data that is written into the memory pool used for network buffers. As the upper stack recycles these net_bufs for legitimate internal use, the attacker overwrites critical kernel structures, function pointers, or data, leading to control-flow hijacking or systemic denial of service."
}