GHSA-f366-4rvv-95x2: Cryptoauthlib Buffer Overflow Vulnerability

LOW
Share
CWE-120
Published
Advisory Summary

GHSA-f366-4rvv-95x2 is a LOW buffer overflow vulnerability (CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) affecting Cryptoauthlib libraries in the PyPI ecosystem. The issue involves buffer overflow in deprecated usb hals and stack overflow in usb enumeration. Remediation is available by upgrading affected packages to version 20200912.

GHSA-f366-4rvv-95x2 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-f366-4rvv-95x2
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Product Cryptoauthlib
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix GHSA-f366-4rvv-95x2

To remediate this vulnerability, upgrade all affected Cryptoauthlib dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

cryptoauthlib fixed: 20200912 
pip install cryptoauthlib>=20200912
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show cryptoauthlib

How to Check if You Are Affected

To determine whether your Python environment is affected by GHSA-f366-4rvv-95x2, inspect your installed packages using pip:

pip show cryptoauthlib

Analyze the terminal output to locate any version of Cryptoauthlib in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 20200912), your application is affected.

Note: The pip show cryptoauthlib command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), where the product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. In Cryptoauthlib, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact 1) If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to the stack. HALs intended for production use are unaffected (I2C, SWI, & SPI) as well as the hidapi HAL (hal_all_platforms_kit_hidapi.c). 2) The hidapi HAL can be made to overrun the application stack by attaching more than 10 (real or virtual) devices likely resulting in an application crash as this does not allow arbitrary data to be written to the stack. ### Patches USB kit enumeration has been patched in v3.2.3 for the hidapi HAL (hal_all_platforms_kit_hidapi.c). ### Removal of deprecated HALs Deprecated usb kit HALs have been removed in v3.2.3. ### Workarounds This vulnerability is limited to users of the kit protocol which is used with Microchip kits and kit firmware to bridge communication from USB-HID to I2C or SWI. It is not expected that kits would be used in an production environment. This is an optional component for users as well so they can always compile the library without the usb support option. ### Special python packaging notes The python package for cryptoauthlib uses date codes for identifying versions. The patched version for python packages is 20200912 ### References Please see [Microchip PSIRT](https://www.microchip.com/design-centers/embedded-security/how-to-report-potential-product-security-vulnerabilities) for Microchip's security policy and reporting procedures ### Credits Special thanks to Ruben Santamarta of [IOActive](https://blogs.ioactive.com/) for reporting

GHSA-f366-4rvv-95x2 Affected Cryptoauthlib Versions

1 component(s)
Fixed Versions:
20200912
Product / Package Ecosystem Affected Versions Fixed Version
cryptoauthlib
pypi/cryptoauthlib
PyPI
< 20200912
20200912

References

GitHub Advisory / Wiki ADVISORY
https://github.com/MicrochipTech/cryptoauthlib/security/advisories/GHSA-f366-4rvv-95x2
Cryptoauthlib Source Repository REPOSITORY
https://github.com/MicrochipTech/cryptoauthlib

Frequently Asked Questions

What is GHSA-f366-4rvv-95x2?
GHSA-f366-4rvv-95x2 is a security vulnerability in Cryptoauthlib involving Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration under CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow').
Which Cryptoauthlib versions are affected?
Affected versions include releases prior to 20200912 across affected packages: cryptoauthlib.
What version fixes GHSA-f366-4rvv-95x2?
Upgrading to 20200912 (or the latest patched release for your respective branch) resolves the vulnerability.
Is cryptoauthlib affected?
Yes, cryptoauthlib is affected in releases prior to 20200912. Upgrade your dependency to 20200912 or later.
What CWE is associated with GHSA-f366-4rvv-95x2?
GHSA-f366-4rvv-95x2 is classified under CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.).
How can I check PyPI dependencies for GHSA-f366-4rvv-95x2?
Run the dependency tree command: 'pip show cryptoauthlib'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f366-4rvv-95x2",
  "modified" : "2021-10-04T21:23:53Z",
  "published" : "2020-10-02T16:33:19Z",
  "aliases" : [ ],
  "summary" : "Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration",
  "details" : "### Impact\n1) If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to the stack. HALs intended for production use are unaffected (I2C, SWI, & SPI) as well as the hidapi HAL (hal_all_platforms_kit_hidapi.c).\n\n2) The hidapi HAL can be made to overrun the application stack by attaching more than 10 (real or virtual) devices likely resulting in an application crash as this does not allow arbitrary data to be written to the stack.\n\n### Patches\nUSB kit enumeration has been patched in v3.2.3 for the hidapi HAL (hal_all_platforms_kit_hidapi.c).\n\n### Removal of deprecated HALs\nDeprecated usb kit HALs have been removed in v3.2.3.\n\n### Workarounds\nThis vulnerability is limited to users of the kit protocol which is used with Microchip kits and kit firmware to bridge communication from USB-HID to I2C or SWI. It is not expected that kits would be used in an production environment. This is an optional component for users as well so they can always compile the library without the usb support option.\n\n### Special python packaging notes\nThe python package for cryptoauthlib uses date codes for identifying versions. The patched version for python packages is 20200912\n\n### References\nPlease see [Microchip PSIRT](https://www.microchip.com/design-centers/embedded-security/how-to-report-potential-product-security-vulnerabilities) for Microchip's security policy and reporting procedures\n\n### Credits\nSpecial thanks to Ruben Santamarta of [IOActive](https://blogs.ioactive.com/) for reporting",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "cryptoauthlib"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "20200912"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MicrochipTech/cryptoauthlib/security/advisories/GHSA-f366-4rvv-95x2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MicrochipTech/cryptoauthlib"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-120" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-10-02T16:27:28Z",
    "nvd_published_at" : null
  }
}