CVE-2024-25393

Executive Summary

CVE-2024-25393 identifies a critical stack buffer overflow vulnerability in the AT server component (net/at/src/at_server.c) of RT-Thread, an open-source real-time operating system (RTOS). The flaw exists in versions up to and including 5.0.2. An unauthenticated attacker can trigger a stack buffer overflow by sending a specially crafted AT command to the vulnerable service, potentially leading to remote code execution (RCE) or denial of service (DoS). The vulnerability is classified as a stack-based buffer overflow (CWE-121) and is remotely exploitable without authentication. No public proof-of-concept (PoC) or patch details are currently available, making this a high-priority zero-day for systems running RT-Thread with the AT server enabled.

Supply Chain & Package Security

RT-Thread is a widely used RTOS in IoT and embedded systems. The AT server component is commonly used for modem and network communication. This vulnerability could be exploited in supply chain attacks targeting devices that rely on RT-Thread for connectivity, such as industrial controllers, smart home devices, and telecommunication equipment. The lack of a patch increases the risk of widespread exploitation.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full system compromise possible.
• Integrity (I): High – Attacker can modify system state.
• Availability (A): High – Denial of service is possible.

Threat Level: Critical. The vulnerability is remotely exploitable, requires no authentication, and can lead to full system compromise. The absence of a patch and public PoC increases the urgency for defensive measures.

Deep Dive & Mechanics

The vulnerability resides in the AT server implementation within net/at/src/at_server.c. The AT server processes incoming AT commands from serial or network interfaces. A stack buffer overflow occurs when the server copies user-supplied data into a fixed-size stack buffer without proper bounds checking. Specifically, the function responsible for parsing AT command parameters does not validate the length of the input before copying it into a local buffer. An attacker can send a crafted AT command with an excessively long parameter, causing the buffer to overflow and overwrite adjacent stack memory, including the return address.

The vulnerable code path is triggered when the AT server receives a command that includes a parameter string longer than the allocated buffer size. The overflow can corrupt the stack, leading to arbitrary code execution or a crash. Since the AT server often runs with elevated privileges in RT-Thread, successful exploitation could give an attacker full control over the device.

Vulnerable vs. Patched Code

Vulnerable Code (RT-Thread <= 5.0.2):

// net/at/src/at_server.c
static void at_parse_cmd(char *cmd, int len) {
    char buf[64]; // Fixed-size stack buffer
    // No length check before copy
    strcpy(buf, cmd); // Vulnerable: potential overflow
    // ... further processing
}

Patched Code (Hypothetical fix):

// net/at/src/at_server.c
static void at_parse_cmd(char *cmd, int len) {
    char buf[64]; // Fixed-size stack buffer
    // Safe copy with length check
    if (len >= sizeof(buf)) {
        // Handle error or truncate
        return;
    }
    strncpy(buf, cmd, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = '\0';
    // ... further processing
}

The vulnerable code uses strcpy without checking the length of the input, while the patched version uses strncpy with proper bounds checking. The fix ensures that the buffer is not overflowed.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: Use a virtual machine running RT-Thread 5.0.2 with the AT server enabled on a network interface.
2. Tools: Python with socket library, GDB for debugging, and a custom exploit script.

Exploitation Steps:

1. Identify the target device running RT-Thread with the AT server on a known port (e.g., TCP 23 or serial).
2. Send a crafted AT command with a long parameter to trigger the overflow:

   import socket
   target_ip = "192.168.1.100"
   target_port = 23
   payload = b"AT+COMMAND=" + b"A" * 200 + b"\r\n"
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((target_ip, target_port))
   s.send(payload)
   s.close()
   

3. Monitor the device for a crash or use GDB to control execution flow. Overwrite the return address with a pointer to shellcode to achieve RCE.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for unusually long AT command strings in network traffic.
• Use intrusion detection systems (IDS) to alert on patterns like AT+[A-Z]+=[A-Za-z0-9]{100,}.
• Enable stack canaries and ASLR in RT-Thread if supported.

Mitigation:

• Disable the AT server if not needed.
• Apply input validation and length checks in custom patches.
• Use a Web Application Firewall (WAF) or network filter to block oversized AT commands.

Indicators of Compromise (IOCs)

• Network Traffic: AT commands with parameters exceeding 64 bytes.
• Logs: Repeated crashes or reboots of the AT server process.
• Memory: Stack corruption patterns in device memory dumps.
• File System: Unexpected binaries or scripts in /tmp or /var.

Detection Engineering

YARA Rule

rule CVE_2024_25393_AT_Server_Overflow {
    meta:
        description = "Detects stack buffer overflow in RT-Thread AT server"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-25393"
    strings:
        $s1 = "AT+" ascii wide nocase
        $s2 = { 41 41 41 41 } // Pattern of 'AAAA' overflow
    condition:
        $s1 and #s2 > 10
}

Sigma Rule

title: CVE-2024-25393 RT-Thread AT Server Buffer Overflow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-25393 via oversized AT commands
author: Valters IT
logsource:
    category: network
    product: tcp
detection:
    selection:
        payload|contains: "AT+"
        payload|length: > 100
    condition: selection
falsepositives:
    - Legitimate long AT commands (rare)
level: high

Suricata Rule

alert tcp any any -> any 23 (msg:"CVE-2024-25393 RT-Thread AT Server Buffer Overflow Attempt"; flow:to_server,established; content:"AT+"; depth:3; byte_test:1,>,64,0,relative; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the AT server if not required for operation.
2. Apply network segmentation to limit access to devices running RT-Thread.
3. Monitor for exploitation attempts using the provided detection rules.

Long-term Fix:

• Patch the firmware once an official update is released by RT-Thread.
• Implement input validation in custom code to prevent buffer overflows.
• Use stack protection mechanisms (e.g., stack canaries) in the RT-Thread build.

Workaround:

• If patching is not possible, restrict access to the AT server port (e.g., TCP 23) using firewall rules to trusted IPs only.

Valters IT