RT-Thread Version
v5.3.0/git-hash: cda0a63
Affected area
FinSH
Hardware/BSP vendor
STM32
Architecture
ARM / AArch64
Board and hardware details
bsp/stm32/stm32f407-atk-explorer
Develop Toolchain
GCC
Describe the bug
Description
A critical Heap Out-of-Bounds (OOB) Write vulnerability (CWE-122) exists within the RT-Thread FinSH component, specifically in the path auto-completion logic (msh_auto_complete_path or related directory parsing functions).
When a user interacts with the msh shell (e.g., via a serial terminal or a remote network console) and attempts to trigger path auto-completion (typically using the <Tab> key) on an excessively long or deeply nested directory string, the underlying string manipulation routine fails to enforce strict boundary checks.
The function allocates a fixed-size buffer on the heap (often bounded by macros like RT_PATH_MAX or a hardcoded 256 bytes, e.g., full_path). During the concatenation of the current working directory and the user-supplied input, a while loop or strcpy/memcpy equivalent copies the oversized input string past the allocated bounds of the heap buffer.
This silent memory corruption overwrites adjacent heap metadata. The system does not crash immediately upon the OOB write. However, during the next memory allocation or deallocation cycle, the corrupted heap metadata is dereferenced, leading to an immediate HardFault or offering an attacker the potential for Heap-based Arbitrary Code Execution.
Prerequisites to Reproduce
- The FinSH/msh component is enabled and accessible to the user/attacker.
- The
RT_USING_DFS (Device Virtual File System) and RT_USING_DFS_DEVFS are enabled, allowing directory traversal and path completion.
Steps to Reproduce
- Boot the RT-Thread system and connect to the FinSH interactive shell (via UART or Telnet).
- Input an excessively long string intended as a directory path. For example, input
cd / followed by a payload of over 256 'A' characters:
msh > cd /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
- Trigger the auto-complete function (usually by sending the
\t (Tab) character via the input stream).
- The
msh_auto_complete_path function attempts to parse and concatenate the path. The oversized string silently overflows the full_path heap buffer.
- Execute any subsequent command that requires dynamic memory allocation (e.g.,
ls or running a network task).
- The system throws a HardFault (or MemManage fault) due to corrupted heap metadata during
rt_malloc or rt_free.
Other additional context
No response
RT-Thread Version
v5.3.0/git-hash: cda0a63
Affected area
FinSH
Hardware/BSP vendor
STM32
Architecture
ARM / AArch64
Board and hardware details
bsp/stm32/stm32f407-atk-explorer
Develop Toolchain
GCC
Describe the bug
Description
A critical Heap Out-of-Bounds (OOB) Write vulnerability (CWE-122) exists within the RT-Thread FinSH component, specifically in the path auto-completion logic (
msh_auto_complete_pathor related directory parsing functions).When a user interacts with the
mshshell (e.g., via a serial terminal or a remote network console) and attempts to trigger path auto-completion (typically using the<Tab>key) on an excessively long or deeply nested directory string, the underlying string manipulation routine fails to enforce strict boundary checks.The function allocates a fixed-size buffer on the heap (often bounded by macros like
RT_PATH_MAXor a hardcoded256bytes, e.g.,full_path). During the concatenation of the current working directory and the user-supplied input, awhileloop orstrcpy/memcpyequivalent copies the oversized input string past the allocated bounds of the heap buffer.This silent memory corruption overwrites adjacent heap metadata. The system does not crash immediately upon the OOB write. However, during the next memory allocation or deallocation cycle, the corrupted heap metadata is dereferenced, leading to an immediate HardFault or offering an attacker the potential for Heap-based Arbitrary Code Execution.
Prerequisites to Reproduce
RT_USING_DFS(Device Virtual File System) andRT_USING_DFS_DEVFSare enabled, allowing directory traversal and path completion.Steps to Reproduce
cd /followed by a payload of over 256 'A' characters:msh > cd /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...\t(Tab) character via the input stream).msh_auto_complete_pathfunction attempts to parse and concatenate the path. The oversized string silently overflows thefull_pathheap buffer.lsor running a network task).rt_mallocorrt_free.Other additional context
No response