EUVD-2025-17441Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function sys_thread_sigprocmask of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument how leads to improper validation of array index.
AnalysisAI
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated local attackers to read and modify kernel memory with high impact. The vulnerability exists in the sys_thread_sigprocmask function where improper validation of the 'how' parameter enables out-of-bounds array access, potentially leading to privilege escalation or denial of service. This is an actively exploitable vulnerability requiring local access and low privileges with no user interaction needed.
Technical ContextAI
RT-Thread is a real-time operating system kernel commonly used in embedded IoT and microcontroller applications. The vulnerability resides in the lwp (Lightweight Process) syscall interface at rt-thread/components/lwp/lwp_syscall.c, specifically in the sys_thread_sigprocmask function. This function implements POSIX signal masking functionality (pthread_sigmask equivalent) but fails to properly validate the 'how' parameter before using it as an array index. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates the root cause is insufficient bounds checking on array indexing, allowing reads/writes beyond allocated buffer boundaries. The 'how' parameter should be validated against a limited set of valid values (typically SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK) before being used to index into kernel data structures.
RemediationAI
Immediate actions: (1) Upgrade to a patched version of RT-Thread beyond 5.1.0 when available from the RT-Thread project repositories. Check rt-thread.io or GitHub (github.com/RT-Thread/rt-thread) for security advisories and patches. (2) If immediate patching is not possible, implement input validation in sys_thread_sigprocmask to explicitly check that the 'how' parameter is one of the valid POSIX values (SIG_BLOCK=0, SIG_UNBLOCK=1, SIG_SETMASK=2) before using it as an array index—reject any other values with -EINVAL. (3) Consider restricting signal mask syscalls via security policies if not required for the application. (4) Apply principle of least privilege to minimize user accounts with syscall access in production deployments. Monitor RT-Thread security bulletins and community advisories for patch release timelines.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within t
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.4), th
Same weakness CWE-119 – Buffer Overflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today