CVE-2025-55095

Executive Summary

CVE-2025-55095 is a denial-of-service vulnerability in the Eclipse ThreadX USBX stack, specifically within the _ux_host_class_storage_media_mount() function. The flaw arises from uncontrolled recursion when processing extended partition entries on a USB mass storage device. An attacker with physical access can craft a malicious USB drive containing a cyclic or deeply nested extended partition table, causing the USBX stack to recurse indefinitely until a stack overflow occurs. This results in a system crash or hang, effectively denying service to the host system. The vulnerability has a CVSS score of 4.2 (Medium) and is currently unpatched. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects the Eclipse ThreadX USBX stack, which is a real-time operating system component used in embedded systems, IoT devices, and industrial controllers. The supply chain risk is significant because the vulnerable code is often integrated into firmware images by device manufacturers. A malicious USB drive could be used to crash devices in critical infrastructure, medical equipment, or automotive systems. Organizations should audit their use of ThreadX USBX and apply any vendor-supplied patches as soon as they become available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Physical (P) – The attacker must have physical access to the device to insert a malicious USB drive.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication or privileges are needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond inserting the USB drive.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The system becomes unavailable due to stack overflow and crash.

Threat Level: Medium. While the attack requires physical access, the impact on availability is high, and the attack complexity is low. In environments where USB ports are accessible (e.g., kiosks, embedded systems, industrial controllers), this poses a real risk.

Deep Dive & Mechanics

The vulnerability resides in the USBX host stack's handling of partition tables on USB mass storage devices. The function _ux_host_class_storage_media_mount() is responsible for mounting partitions. When it encounters an extended partition entry (type UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED or EXTENDED_LBA_MAPPED), it recursively calls itself to mount the next logical partition.

The recursion occurs in _ux_host_class_storage_partition_read(), which parses up to four partition entries. If an extended partition is found, the code invokes:

_ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(...));

There is no limit on the recursion depth or tracking of visited sectors. A malicious disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.

Key Code Path:

1. _ux_host_class_storage_media_mount() is called for a USB mass storage device.
2. It calls _ux_host_class_storage_partition_read() to read the partition table.
3. If an extended partition is found, it recursively calls _ux_host_class_storage_media_mount() with the next sector.
4. This recursion continues indefinitely if the partition table contains a cycle or a very deep chain.

Root Cause: Lack of recursion depth limit and absence of visited sector tracking.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

UINT _ux_host_class_storage_media_mount(UX_HOST_CLASS_STORAGE *storage, ULONG sector)
{
    // ... read partition table ...
    for (int i = 0; i < 4; i++) {
        if (partition_type == UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED ||
            partition_type == EXTENDED_LBA_MAPPED) {
            // Recursive call without depth limit
            _ux_host_class_storage_media_mount(storage, sector + offset);
        }
    }
}

Patched Code (hypothetical):

UINT _ux_host_class_storage_media_mount(UX_HOST_CLASS_STORAGE *storage, ULONG sector, UINT depth)
{
    // Limit recursion depth to prevent stack overflow
    if (depth > MAX_PARTITION_DEPTH) {
        return UX_ERROR;
    }
    // ... read partition table ...
    for (int i = 0; i < 4; i++) {
        if (partition_type == UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED ||
            partition_type == EXTENDED_LBA_MAPPED) {
            // Pass incremented depth
            _ux_host_class_storage_media_mount(storage, sector + offset, depth + 1);
        }
    }
}

The patch introduces a depth parameter and a maximum depth check (MAX_PARTITION_DEPTH). Additionally, a set of visited sectors should be tracked to prevent cycles.

Exploitation & Lab Setup

Red Team

Objective: Craft a malicious USB drive that causes a stack overflow on a target device running Eclipse ThreadX USBX.

Lab Setup:

• A device running Eclipse ThreadX with USBX host stack (e.g., a development board like STM32F4 Discovery with ThreadX port).
• A USB flash drive (any size).
• A Linux host with dd and hexdump tools.

Steps:

1. Create a disk image with a cyclic extended partition table:

   dd if=/dev/zero of=malicious.img bs=512 count=1000
   

2. Use a hex editor to modify the Master Boot Record (MBR) at sector 0. Set the first partition entry to an extended partition type (0x05 or 0x0F) pointing to sector 1.
3. At sector 1, create an extended boot record (EBR) that points back to sector 0 (creating a cycle).
4. Write the image to the USB drive:

   dd if=malicious.img of=/dev/sdX bs=512
   

5. Insert the USB drive into the target device. The device will attempt to mount the partitions, enter infinite recursion, and crash.

Expected Outcome: The device hangs or crashes due to stack overflow. Logs may show a stack trace or watchdog timeout.

Blue Team

Detection:

• Monitor system logs for USB mass storage errors or stack overflow messages.
• Use behavioral analysis to detect unusual recursion patterns in the USBX stack.
• Implement USB device whitelisting to only allow known, trusted USB drives.

Prevention:

• Apply vendor patches as soon as they become available.
• Disable USB mass storage support if not required.
• Use USB port blockers or disable USB ports in sensitive environments.
• Implement input validation on partition table parsing (depth limit, cycle detection).

Response:

• If a crash occurs, collect the crash dump and analyze the stack trace for signs of recursion in _ux_host_class_storage_media_mount.
• Isolate the affected device and scan it for other vulnerabilities.
• Update the USBX stack to a patched version.

Indicators of Compromise (IOCs)

• File System: A USB mass storage device with a partition table containing a cycle (e.g., an extended partition pointing to a sector that eventually points back to itself).
• Behavior: System crash or hang immediately after inserting a USB drive.
• Logs: Stack overflow errors, watchdog timeout, or kernel panic messages related to USB storage.
• Memory: Stack memory exhaustion in the USBX host stack thread.

Example IOC (hex dump of malicious MBR):

000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
000001c0  01 00 05 fe ff ff 01 00  00 00 01 00 00 00 00 00
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa

The partition entry at offset 0x1c2 has type 0x05 (extended) and points to sector 1 (LBA 1).

Detection Engineering

YARA Rule

rule CVE_2025_55095_USB_Partition_Cycle {
    meta:
        description = "Detects malicious USB disk images with cyclic extended partition tables"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55095"
    strings:
        $mbr_signature = {55 aa}
        $extended_type = {05 0f}
    condition:
        $mbr_signature at 0 and
        for any of ($extended_type) : (
            // Check if extended partition points to a sector that could create a cycle
            // Simplified: check if the starting LBA is within the first few sectors
            uint32(uint8(0x1c6)) < 10
        )
}

Sigma Rule

title: CVE-2025-55095 USB Stack Overflow Detection
id: cve-2025-55095-usb-stack-overflow
status: experimental
description: Detects stack overflow events related to USB mass storage partition parsing
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: kernel
detection:
    selection:
        - "stack overflow" and "USB"
        - "usb" and "partition" and "error"
        - "watchdog" and "usb_storage"
    condition: selection
falsepositives:
    - Legitimate USB drives with complex partition tables (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-55095 USB Partition Cycle Attempt"; flow:to_server; content:"|55 aa|"; offset:510; depth:2; content:"|05|"; offset:450; within:16; sid:1000001; rev:1;)

Note: Suricata rules for USB attacks are limited because USB traffic is not typically inspected at the network level. This rule is a placeholder for environments where USB traffic is encapsulated (e.g., USB over IP).

Remediation & Mitigation

1. Patch: Apply vendor patches as soon as they become available. Monitor the Eclipse ThreadX project for updates.
2. Workaround: If patching is not possible, disable USB mass storage support in the USBX configuration:

   // In ux_user.h
   #define UX_HOST_CLASS_STORAGE_DISABLE
   

3. Input Validation: Implement a recursion depth limit (e.g., 8 levels) and track visited sectors to prevent cycles.
4. Physical Security: Restrict physical access to devices. Use USB port locks or disable USB ports in sensitive environments.
5. Monitoring: Enable logging for USB events and monitor for unusual partition table structures.
6. Device Hardening: Use USB device whitelisting to only allow known, trusted USB drives.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert