Rt Thread EUVD-2025-17441

The CVSS 3.1 score of 8.0 with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates significant real-world risk: Attack Vector Adjacent Network limits exposure to directly connected networks (embedded systems in lab/facility environments); however, many RT-Thread deployments are isolated or WiFi-adjacent, making this practical. Access Complexity Low and Privileges Low mean any authenticated user can trigger this without special conditions. The vulnerability impacts Confidentiality, Integrity, and Availability equally (all High), suggesting complete system compromise is possible through memory disclosure or kernel code corruption. The lack of user interaction (UI:N) and unchanged scope (local kernel memory, S:U) make this reliably exploitable. While KEV status and EPSS scores are not provided in the input data, the combination of low attack complexity, low privilege requirement, and complete impact across CIA triad suggests exploitation probability is HIGH. This is a genuine priority vulnerability for RT-Thread deployments, particularly in networked IoT devices.

An attacker with a local user account on an RT-Thread IoT device (e.g., obtained through weak credentials or another vulnerability) calls the pthread_sigmask syscall with a crafted 'how' parameter containing an out-of-bounds index value (e.g., 999 instead of 0-2). This bypasses the bounds check in sys_thread_sigprocmask and causes the kernel to read from or write to arbitrary kernel memory locations relative to the signal mask array. The attacker can leak kernel pointers and ASLR offsets (Confidentiality impact), corrupt kernel data structures or function pointers (Integrity impact), or crash the device (Availability impact). No proof-of-concept code is referenced in the provided data, but the vulnerability is sufficiently documented in the CVE description to enable rapid POC development. Attack complexity is low because the vulnerable syscall is standard POSIX and can be triggered through libc wrappers or direct syscall invocation; no special race conditions or timing are required. The adjacent network attack vector suggests this is most practical in controlled environments (labs, factories, offices) rather than Internet-exposed devices, but internal networks are common in industrial IoT deployments.