CVE-2024-25389

Executive Summary

CVE-2024-25389 identifies a critical weakness in the random number generation algorithm used by RT-Thread, an open-source real-time operating system (RTOS). The vulnerability resides in the calc_random function within drivers/misc/rt_random.c. The algorithm employs a linear congruential generator (LCG) with a fixed, well-known formula: seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;. This LCG is predictable and cryptographically insecure, allowing an attacker who can observe or influence the output to reconstruct the internal state and predict future random numbers. This can lead to severe security breaches, including session hijacking, cryptographic key compromise, and bypass of security mechanisms that rely on randomness.

Supply Chain & Package Security

RT-Thread is a widely used RTOS in embedded systems, IoT devices, and industrial control systems. The vulnerability is embedded in the core kernel source code, affecting all downstream projects and products that incorporate RT-Thread versions up to and including 5.0.2. Since the patch status is unknown, the entire supply chain relying on this component is at risk. Developers and vendors must treat this as a critical supply chain security issue and verify the integrity of their random number generation.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) – However, based on the nature of the vulnerability, a more realistic assessment is provided below.

Adjusted CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score: 9.8 (Critical)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely if the attacker can observe random outputs (e.g., via network protocol).
• Attack Complexity (AC): Low – The algorithm is deterministic and well-documented.
• Privileges Required (PR): None – No authentication needed to exploit.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the only one affected.
• Confidentiality (C): High – Predictable random numbers can expose sensitive data.
• Integrity (I): High – Attackers can forge tokens or cryptographic keys.
• Availability (A): High – Could lead to denial of service or system compromise.

Threat Level: Critical. The vulnerability undermines the security of any cryptographic or security-sensitive operation relying on randomness.

Deep Dive & Mechanics

The calc_random function implements a classic LCG with parameters:

• Multiplier: 214013
• Increment: 2531011
• Modulus: 2^32 (implicitly via 32-bit integer overflow)
• Output: (seed >> 16) & 0x7FFF (15 bits)

This LCG is identical to the one used in Microsoft Visual C++'s rand() function, which is known to be cryptographically weak. The internal state (seed) can be recovered from a small number of consecutive outputs using linear algebra or brute force (since the state space is only 2^32). Once the state is known, all future and past outputs can be predicted.

Attack Scenario:

1. An attacker collects two consecutive 15-bit outputs from the device (e.g., session IDs, nonces, or cryptographic keys).
2. Using the known LCG parameters, the attacker can solve for the seed.
3. With the seed, the attacker can predict all subsequent random numbers, potentially hijacking sessions, forging authentication tokens, or decrypting communications.

Vulnerable vs. Patched Code

Vulnerable Code (RT-Thread <= 5.0.2):

// drivers/misc/rt_random.c
static unsigned long seed = 1;

unsigned long calc_random(void)
{
    seed = 214013L * seed + 2531011L;
    return (seed >> 16) & 0x7FFF;
}

Patched Code (Hypothetical – No official patch available):

// drivers/misc/rt_random.c
#include <rtthread.h>
#include <stdlib.h>

// Use hardware RNG if available, otherwise fallback to a secure software CSPRNG
unsigned long calc_random(void)
{
    unsigned long random_value;
    // Attempt to use hardware random number generator
    if (rt_hw_random_get(&random_value) == RT_EOK)
    {
        return random_value;
    }
    // Fallback to a cryptographically secure PRNG (e.g., ChaCha20-based)
    // Implementation omitted for brevity
    return secure_random();
}

Key Differences:

• The vulnerable code uses a deterministic LCG with a fixed formula.
• The patched code should use a hardware random number generator (if available) or a cryptographically secure pseudorandom number generator (CSPRNG) like ChaCha20 or AES-CTR-DRBG.

Exploitation & Lab Setup

Red Team

Objective: Predict random numbers generated by an RT-Thread device to compromise security.

Lab Setup:

1. Environment: QEMU emulating an ARM Cortex-M4 board running RT-Thread 5.0.2.
2. Tools: Python 3, pwntools, and a custom script to interact with the device's random number interface.

Exploitation Steps:

1. Collect Outputs: Intercept two consecutive random numbers from the device (e.g., via network packets or serial output).
2. Recover Seed: Use the following Python script to brute-force the seed:

   def lcg(seed):
       return (214013 * seed + 2531011) & 0xFFFFFFFF
   
   def get_output(seed):
       return (lcg(seed) >> 16) & 0x7FFF
   
   def recover_seed(output1, output2):
       for seed in range(2**32):
           if get_output(seed) == output1 and get_output(lcg(seed)) == output2:
               return seed
       return None
   
   # Example usage
   observed_outputs = [12345, 6789]  # Replace with actual intercepted values
   seed = recover_seed(observed_outputs[0], observed_outputs[1])
   print(f"Recovered seed: {seed}")
   

3. Predict Future Outputs: Once the seed is known, generate all future random numbers.

Note: This is a proof-of-concept. In real-world scenarios, the attacker may need to automate the collection and prediction process.

Blue Team

Objective: Detect and mitigate exploitation attempts.

Detection Strategy:

• Monitor for unusual patterns in random number generation (e.g., repeated sequences).
• Implement anomaly detection on network traffic to identify session hijacking attempts.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to a patched version of RT-Thread once available.
• If no patch is available, replace the random number generator with a hardware RNG or a CSPRNG.
• Implement rate limiting and additional entropy sources.

Indicators of Compromise (IOCs)

• Network: Predictable session IDs or nonces that follow the LCG pattern.
• System: Unusual cryptographic key generation failures or repeated keys.
• Logs: Entries indicating repeated authentication attempts with predictable tokens.

Specific IOCs:

• Consecutive random numbers that satisfy the LCG recurrence relation.
• Session IDs that are 15-bit values and can be predicted using the LCG formula.

Detection Engineering

YARA Rule

rule CVE_2024_25389_RT_Thread_Weak_RNG
{
    meta:
        description = "Detects the weak LCG algorithm in RT-Thread calc_random function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-25389"
        hash = "d41d8cd98f00b204e9800998ecf8427e"

    strings:
        $lcg1 = "214013L * seed + 2531011L" ascii wide
        $lcg2 = "(seed >> 16) & 0x7FFF" ascii wide
        $func_name = "calc_random" ascii wide

    condition:
        any of ($lcg1, $lcg2) and $func_name
}

Sigma Rule

title: Detection of Weak Random Number Generator in RT-Thread
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects the use of the weak LCG algorithm in RT-Thread's calc_random function
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25389
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rtthread.elf'
        CommandLine|contains: 'calc_random'
    condition: selection
falsepositives:
    - Legitimate use of the vulnerable RT-Thread version
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-25389 - Predictable Random Number in RT-Thread"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; reference:cve,2024-25389; classtype:attempted-recon; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder. Actual detection would require deep packet inspection of application-layer protocols that expose random numbers.

Remediation & Mitigation

Immediate Actions:

1. Replace the RNG: Modify the source code to use a cryptographically secure random number generator (e.g., getrandom() syscall, OpenSSL's RAND_bytes(), or a hardware RNG).
2. Apply Patch: Monitor the RT-Thread project for an official patch. If none is available, implement the fix internally.
3. Audit Dependencies: Check all products and systems using RT-Thread for this vulnerability.

Long-term Mitigations:

• Code Review: Conduct a security audit of all cryptographic and random number generation code.
• Entropy Sources: Ensure the system has access to sufficient entropy (e.g., hardware RNG, jitter entropy).
• Update Policy: Establish a process for timely updates of the RT-Thread kernel.

Workaround:

• If patching is not immediately possible, disable any functionality that relies on calc_random and use an external secure random source.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert