RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rtfree() on close, causing denial of service.

A flaw has been found in RT-Thread up to 5.2.2. Affected is the function read/write/sysioctl of the file components/lwp/lwpsyscall.c of the component Parameter Handler. Executing a manipulation can lead to divide by zero. The attack may be launched remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CANReceive in the library bsp/synwit/libraries/SWM341CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1ccan.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sysdeviceopen/sysdeviceread/sysdevicecontrol/sysdeviceinit/sysdeviceclose/sysdevicewrite of the file components/drivers/core/device.c. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0. Affected is the function sysrecvfrom of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument from leads to memory corruption.

A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function systhreadsigprocmask of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument how leads to improper validation of array index.

A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability affects the function csyssendto of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument to leads to null pointer dereference.

A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function syssigprocmask of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument how leads to improper validation of array index.

A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sysselect of the file rt-thread/components/lwp/lwpsyscall.c of the component Parameter Handler. The manipulation of the argument timeout leads to memory corruption. The vendor explains, that "[t]he timeout parameter should be checked to check if it can be accessed correctly in kernel mode and used temporarily in kernel memory."

A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sysdeviceclose/sysdevicecontrol/sysdevicefind/sysdeviceinit/sysdeviceopen/sysdeviceread/sysdeviceregister/sysdevicewrite/syseventdelete/syseventrecv/syseventsend/sysmbdelete/sysmbrecv/sysmbsend/sysmbsendwait/sysmqrecv/sysmqsend/sysmqurgent/sysmutexdelete/sysmutexrelease/sysmutextake/sysrttimercontrol/sysrttimerdelete/sysrttimerstart/sysrttimerstop/syssemdelete/syssemrelease/syssemtake/sysshmat/sysshmdt/systhreadcreate/systhreaddelete/systhreadstartup/systimerdelete/systimergettime/systimersettime of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument arg[0] leads to information disclosure. An attack has to be approached locally.

A heap buffer overflow occurs in dfsv2 dfsfile in RT-Thread through 5.0.2.

drivers/wlan/wlanmgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.

A heap buffer overflow occurs in the dfsv2 romfs filesystem RT-Thread through 5.0.2.

RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calcrandom in drivers/misc/rtrandom.c.

A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2.

A heap buffer overflow occurs in finsh/mshfile.c and finsh/msh.c in RT-Thread through 5.0.2.

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2.

An out-of-bounds access occurs in utilities/varexport/varexport.c in RT-Thread through 5.0.2.

A buffer overflow occurs in utilities/ymodem/rysy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\0' character.

A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2.