EUVD-2025-17440Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sys_select of the file rt-thread/components/lwp/lwp_syscall.c of the component Parameter Handler. The manipulation of the argument timeout leads to memory corruption. The vendor explains, that "[t]he timeout parameter should be checked to check if it can be accessed correctly in kernel mode and used temporarily in kernel memory."
AnalysisAI
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local attackers to corrupt kernel memory by manipulating the timeout parameter. The vulnerability affects the lwp (lightweight process) component and has a CVSS score of 8.0 with potential for code execution, information disclosure, and denial of service. No public exploit code or active in-the-wild exploitation has been confirmed at this time, but the critical severity rating and memory corruption nature warrant immediate patching.
Technical ContextAI
RT-Thread is a real-time operating system commonly deployed in embedded and IoT devices. The vulnerability exists in rt-thread/components/lwp/lwp_syscall.c, specifically in the sys_select function which implements the POSIX select() syscall. The lwp component provides lightweight process support and user-space syscall handling. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates an out-of-bounds memory access issue. The root cause is insufficient validation of the timeout parameter before it is accessed in kernel mode and stored in kernel memory. The timeout parameter, when passed from user-space applications, is not properly checked for validity before kernel use, allowing attackers to write arbitrary values to kernel memory regions or cause buffer overflows. This is a classic boundary condition vulnerability in kernel parameter marshalling where user-supplied data crosses the privilege boundary without adequate sanitization.
RemediationAI
Immediate patching is required. RT-Thread developers should have released a patched version following CVE disclosure. Users should: 1) Update to the latest RT-Thread version >= 5.1.1 or apply the security patch from the vendor; 2) The fix involves proper validation and bounds-checking of the timeout parameter in sys_select before kernel use, including verification that the timeout pointer is accessible in user-space and safe for kernel-mode dereferencing; 3) If immediate patching is not feasible, disable or restrict use of select() syscalls where possible, or limit process privilege levels to reduce attack surface. Vendor advisory links and patch binaries should be obtained from the official RT-Thread GitHub repository (https://github.com/RT-Thread/rt-thread) or security advisories page. Enable kernel memory protection features (ASLR, DEP/NX if supported) to limit exploitation impact.
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within t
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.4), th
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today