CVE-2022-39343: Azure RTOS FileX vulnerable to Buffer Offerflow
First published: Tue Nov 08 2022(Updated: )
Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Azure RTOS | <6.2.0 |
Remedy
https://github.com/azure-rtos/filex/blob/master/common/src/fx_fault_tolerant_apply_logs.c#L218
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-39343?
CVE-2022-39343 is considered to have a high severity level due to the potential for exploitation through buffer overflow.
How do I fix CVE-2022-39343?
To fix CVE-2022-39343, you should upgrade Azure RTOS FileX to version 6.2.0 or later.
What versions of Azure RTOS FileX are affected by CVE-2022-39343?
CVE-2022-39343 affects all versions of Azure RTOS FileX prior to 6.2.0.
What are the consequences of exploiting CVE-2022-39343?
Exploiting CVE-2022-39343 can allow attackers to achieve a buffer overflow, potentially modifying memory contents and leading to unauthorized access.
Is CVE-2022-39343 specific to any operating system or environment?
CVE-2022-39343 is specific to platforms utilizing Azure RTOS FileX version 6.2.0 and below.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/title
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft azure rtos