RT-Thread vulnerabilities

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.

A flaw in RT-Thread up to version 5.2.2 affects the read/write/sys_ioctl functions in components/lwp/lwp_syscall.c. Parameter manipulation can cause a divide-by-zero error, allowing remote attacks. The exploit is published and may be used.

A weakness has been identified in RT-Thread up to version 5.0.2 in the function sys_getaddrinfo in file components/lwp/lwp_syscall.c. Manipulation of the ai_addr argument can lead to memory corruption. The attack requires local access and the exploit is publicly available.

A security flaw in RT-Thread up to version 5.0.2 affects the CAN_Receive function in the SWM341.h file of the SWM341 CAN Handler component. A local attacker can trigger a stack-based buffer overflow through data manipulation. A public exploit is available for attacks.

A stack-based buffer overflow vulnerability was found in RT-Thread up to version 5.0.2 in the ls1c CAN Handler component's recvmsg function. The attack requires local access and the exploit is publicly available.