Null-Dereference READ Vulnerability in TinyUSB Package
Summary
OSV-2025-742: Null-dereference READ in ubsan_GetStackTrace. Affects tinyusb versions >= 0263cfc01ab63d6799e80cbbf691af1979cf3ab7, < 5ef55bfa30d6f8cf175b3d327f621c76aae7b138. Fixed in 5ef55bfa30d6f8cf175b3d327f621c76aae7b138. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TinyUSB is an open-source USB Host/Device stack designed for embedded systems, providing a lightweight and efficient solution for USB communication. It supports various USB classes and is widely used in microcontroller applications. However, it is susceptible to a null-dereference read vulnerability that can lead to application crashes.
Vulnerability Detail
The vulnerability arises from a null-dereference read in the function ubsan_GetStackTrace, which can occur when the function attempts to access memory that has not been properly initialized. This can lead to crashes and potentially allow for denial of service attacks. The issue was reported through OSS-Fuzz, indicating that it was discovered during fuzz testing, a technique used to identify vulnerabilities by inputting random data into programs.
How To Fix
Minimum fixed version
5ef55bfa30d6f8cf175b3d327f621c76aae7b138
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all pointers used in the ubsan_GetStackTrace function are properly initialized before use. This can help mitigate the risk of null-dereference reads until the package is updated.
Conclusion
The null-dereference read vulnerability in the TinyUSB package poses a significant risk of application crashes. It is crucial to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tinyusb →
FAQ
A null-dereference read occurs when a program attempts to access memory through a pointer that has not been initialized, leading to crashes or undefined behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The main consequence is a crash of the application, which can lead to denial of service and affect the reliability of systems using TinyUSB.
Yes, a patch is available in the fixed version 5ef55bfa30d6f8cf175b3d327f621c76aae7b138. Updating to this version will resolve the issue.
If an immediate update is not possible, ensure that all pointers in the relevant functions are initialized to avoid null-dereference reads as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinyusb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
