CVE-2022-39343

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a vali...

CVE-2018-1000800

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sysringbufput, sysringbufget that can result in CPU Page Fault error code 0x00000010. This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs system sysringbufget and...

CVE-2013-2687

Stack-based buffer overflow in the bpedecompress function in 1 BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and 2 QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service application crash or possibly execute...

CVE-2019-7714

An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow...

CVE-2019-7715

An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable ipcom.shell.greeting as the first argument to printf. Setting this variable using the sysvar command results in a...

CVE-2002-2120

Multiple buffer overflows in QNX RTOS 4.25 may allow attackers to execute arbitrary code via long filename arguments to 1 Watcom or 2 int10...

STMicroelectronics X-CUBE-AZRTOS-WL digital error vulnerability

STMicroelectronics X-CUBE-AZRTOS-WL is an Azure RTOS-based development kit for STM32 microcontrollers from STMicroelectronics, Switzerland. A numeric error vulnerability exists in STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, which stems from an integer overflow in the PUT request function o...

STMicroelectronics X-CUBE-AZRTOS-WL security vulnerabilities

STMicroelectronics X-CUBE-AZRTOS-WL is an Azure RTOS-based development kit for STM32 microcontrollers from STMicroelectronics, Switzerland. A security vulnerability exists in STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, which originates from a denial of service in the HTTP server...

STMicroelectronics X-CUBE-AZRTOS-WL security vulnerabilities

STMicroelectronics X-CUBE-AZRTOS-WL is an Azure RTOS-based development kit for STM32 microcontrollers from STMicroelectronics, Switzerland. A security vulnerability exists in STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, which originates from a denial of service in the HTTP server...

STMicroelectronics X-CUBE-AZRTOS-WL buffer error vulnerability

STMicroelectronics X-CUBE-AZRTOS-WL is an Azure RTOS-based development kit for STM32 microcontrollers from STMicroelectronics, Switzerland. A security vulnerability exists in STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0, which stems from a buffer overflow in the FileX internal RAM interface...

PT-2025-7818

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue is related to the function dns copy qname in dns pack.c, which performs a memcpy operation with an untrusted field. It does not check if the source buffer is large enough to contain...

CVE-2021-22636

Texas Instruments TI-RTOS, when configured to use HeapMem heapdefault, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'HeapMemallocUnprotected' and result in code execution...

CVE-2022-29246

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features o...

CVE-2022-29223

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with bNbPorts set to a value greater than UXMAXTT which defaults to 8. For a bNbPorts value of...

CVE-2022-36063

Azure RTOS USBx is a USB host, device, and on-the-go OTG embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integer underflow and a buffer overflow in th...

CVE-2022-39344

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this m...

CVE-2022-39293

Azure RTOS USBX is a high-performance USB host, device, and on-the-go OTG embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in uxhostclasspimaread, there is data length from device response, returned in the very first packet, and read by L165 code, as headerlength. Th...

Zephyr security vulnerabilities

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr 3.7 and earlier versions that stems from improper validation of user input by the olcpindhandler function...

Fuzzing µC/OS protocol stacks, Part 1: HTTP server fuzzing

This is the first post of a three-part series, where we will be delving into the intricacies of fuzzing µC/OS protocol stacks. The techniques I will discuss are universally applicable to various RTOS environments, though our focus will primarily be on µC/OS. Ill highlight some of the strategic co...

Fuzzing µC/OS protocol stacks, Part 3: TCP/IP server fuzzing, implementing a TAP driver

This is the final post in the three-part series that details techniques I used to fuzz two µC/OS protocol stacks: µC/TCP-IP and µC/HTTP-server. The first post highlighted code modifications necessary for developing a fuzzing harness tailored for the µC/HTTP-server. The second discussed a techniqu...