Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

Buffer overflow in deprecated USB HALs and stack overflow in USB enumerationGHSA-f366-4rvv-95x2

GHSA-f366-4rvv-95x2 is a security vulnerability in cryptoauthlib. A fix is available for cryptoauthlib — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 2, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍cryptoauthlib

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

  1. If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to the stack. HALs intended for production use are unaffected (I2C, SWI, & SPI) as well as the hidapi HAL (hal_all_platforms_kit_hidapi.c).

  2. The hidapi HAL can be made to overrun the application stack by attaching more than 10 (real or virtual) devices likely resulting in an application crash as this does not allow arbitrary data to be written to the stack.

Patches

USB kit enumeration has been patched in v3.2.3 for the hidapi HAL (hal_all_platforms_kit_hidapi.c).

Removal of deprecated HALs

Deprecated usb kit HALs have been removed in v3.2.3.

Workarounds

This vulnerability is limited to users of the kit protocol which is used with Microchip kits and kit firmware to bridge communication from USB-HID to I2C or SWI. It is not expected that kits would be used in an production environment. This is an optional component for users as well so they can always compile the library without the usb support option.

Special python packaging notes

The python package for cryptoauthlib uses date codes for identifying versions. The patched version for python packages is 20200912

References

Please see Microchip PSIRT for Microchip's security policy and reporting procedures

Credits

Special thanks to Ruben Santamarta of IOActive for reporting

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIcryptoauthliball versions20200912pip install --upgrade 'cryptoauthlib==20200912'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for cryptoauthlib, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update cryptoauthlib to 20200912 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f366-4rvv-95x2 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact 1) If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to the stack. HALs intended for production use are unaffected (I2C, SWI, & SPI) as well as the hidapi HAL (hal_all_platforms_kit_hidapi.c). 2) The hidapi HAL can be made to overrun the application stack by attaching more than 10 (real or virtual) devices likely resulting in an application crash as this does not allow arbitrary data to be wri
O3 Security · Impact-Aware SCA

Is GHSA-f366-4rvv-95x2 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Buffer overflow in deprecated USB HALs and stack…