EUVD-2025-17443CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability affects the function csys_sendto of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument to leads to null pointer dereference.
Analysis
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authenticated local attackers to cause denial of service and potentially achieve code execution with high integrity impact. The vulnerability requires local access and valid credentials but exploits a memory safety flaw in a core system call handler that could be leveraged for privilege escalation or system instability in embedded/IoT deployments running RT-Thread.
Technical Context
RT-Thread is a real-time operating system commonly used in embedded systems and IoT devices. The vulnerable component is located in rt-thread/components/lwp/lwp_syscall.c, specifically in the csys_sendto function which handles the sendto system call for socket operations. CWE-404 (Improper Resource Validation) indicates that the function fails to properly validate pointer arguments before dereferencing them, resulting in a null pointer dereference condition. The lwp (Lightweight Process) component provides POSIX-like process management on RT-Thread. The vulnerability exists in version 5.1.0 and potentially affects other versions in the same branch. CPE identifier would be: cpe:2.3:a:rt-thread:rt-thread:5.1.0:*:*:*:*:*:*:* and related version ranges.
Affected Products
- vendor: RT-Thread; product: RT-Thread RTOS; affected_version: 5.1.0; component: lwp_syscall.c (Lightweight Process subsystem); cpe: cpe:2.3:a:rt-thread:rt-thread:5.1.0:*:*:*:*:*:*:*; affected_function: csys_sendto; attack_vector: Local/Adjacent Network
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today