Rt Thread EUVD-2025-17443

CVSS 8.0 (High) with CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates moderate attack complexity but significant impact—the attack requires adjacent network access or local access (AV:A) and low privilege (PR:L), with high confidentiality, integrity, and availability impact. The null pointer dereference typically results in denial of service (crash), but combined with high integrity impact suggests potential for information disclosure or control flow hijacking. Without confirmed KEV status or EPSS scoring data, real-world exploitation probability appears moderate: the vulnerability requires local/adjacent access plus valid credentials, limiting opportunistic exploitation. However, in embedded IoT environments where multiple processes run with moderate privilege levels, this represents a genuine priority. The combination of high impact (C:H/I:H/A:H) with achievable prerequisites makes this a credible privilege escalation or system compromise vector despite moderate attack complexity.

An attacker with local shell access (or adjacent network access via a compromised IoT device on the same network segment) invokes a malformed sendto() system call via the lwp subsystem, passing a null or invalid pointer as the destination address argument. The csys_sendto function fails to validate this pointer before dereferencing it, causing a null pointer dereference that crashes the kernel or the calling process. In a multi-process RT-Thread environment, this can be weaponized: (1) for denial of service by repeatedly crashing critical system services, (2) for information disclosure if error handling leaks memory contents, or (3) potentially for code execution if the null pointer dereference can be controlled to write to predictable memory locations. On embedded IoT devices where RT-Thread manages network stacks and firmware updates, compromising system stability or integrity could allow firmware tampering or service disruption. A proof-of-concept would involve crafting a raw socket operation with malformed arguments, likely achievable within minutes of gaining initial local access.