USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), &sector, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…b-test/security/advisories/GHSA-cfrv-c9q2-7cr3 Diğer
• github.com/…ommit/5b6caac844461024520b02337d3a541fbe128f89 Diğer
• github.com/…omanovich/usb-test/releases/tag/release-v1.1.5 Diğer

Kayıt geçmişi

1. 28 Eki 2026 18:42Yayımlandı

İlgili açıklar

• 6,8 CVE-2026-118611Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability
• 5,3 CVE-2026-93536X.Org Server GestureBuildSprite Use-After-Free
• 7,8 CVE-2026-93523X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write
• 7,8 CVE-2026-93522X.Org Server Glamor CopyArea Heap Buffer Overflow
• 7,5 CVE-2026-47235SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
• 7,8 CVE-2026-93521X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow