CVE-2025-1115

Executive Summary

CVE-2025-1115 is a locally exploitable information disclosure vulnerability in RT-Thread, an open-source real-time operating system (RTOS). The flaw resides in the lwp_syscall.c file, affecting multiple system call functions that handle device, event, mailbox, message queue, mutex, semaphore, shared memory, thread, and timer operations. By manipulating the arg[0] argument, an attacker with local access can trigger the disclosure of sensitive kernel memory contents. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the potential for leaking critical system data. No public exploit code or patch is currently available.

Supply Chain & Package Security

RT-Thread is a widely used RTOS in embedded systems, IoT devices, and industrial controllers. The vulnerability affects the core kernel component (lwp_syscall.c), which is part of the RT-Thread source distribution. Since RT-Thread is often integrated into custom firmware and hardware, the supply chain risk is significant. Any device running RT-Thread up to version 5.1.0 is potentially affected, and the lack of a patch means that downstream integrators must implement custom mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): Low (L) – Attacker needs some privileges (e.g., user-level).
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not cross security boundaries.
• Confidentiality (C): High (H) – Full disclosure of kernel memory.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High (7.1) – Local exploitation can leak sensitive kernel data, including credentials, cryptographic keys, or memory layouts.

Deep Dive & Mechanics

The vulnerability is located in rt-thread/components/lwp/lwp_syscall.c. This file implements system call handlers for RT-Thread's lightweight process (LWP) subsystem. The affected functions include:

• sys_device_close, sys_device_control, sys_device_find, sys_device_init, sys_device_open, sys_device_read, sys_device_register, sys_device_write
• sys_event_delete, sys_event_recv, sys_event_send
• sys_mb_delete, sys_mb_recv, sys_mb_send, sys_mb_send_wait
• sys_mq_recv, sys_mq_send, sys_mq_urgent
• sys_mutex_delete, sys_mutex_release, sys_mutex_take
• sys_rt_timer_control, sys_rt_timer_delete, sys_rt_timer_start, sys_rt_timer_stop
• sys_sem_delete, sys_sem_release, sys_sem_take
• sys_shmat, sys_shmdt
• sys_thread_create, sys_thread_delete, sys_thread_startup
• sys_timer_delete, sys_timer_gettime, sys_timer_settime

The root cause is improper validation of the arg[0] parameter. In many of these functions, arg[0] is used as a pointer or index without adequate bounds checking. An attacker can craft a malicious arg[0] value that causes the function to read from an arbitrary kernel memory address, leaking the contents back to user space.

For example, in sys_device_read, the function might use arg[0] as a device handle. If the handle is invalid or points to a kernel structure, the function may return kernel memory data instead of device data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation in RT-Thread <= 5.1.0. A hypothetical patch would involve adding input validation for arg[0] in each affected function.

Vulnerable Code (Example from sys_device_read):

static int sys_device_read(int argc, char **argv)
{
    rt_device_t dev = (rt_device_t)argv[0];
    // No validation of dev pointer
    return rt_device_read(dev, ...);
}

Patched Code (Hypothetical):

static int sys_device_read(int argc, char **argv)
{
    rt_device_t dev = (rt_device_t)argv[0];
    if (!rt_device_is_valid(dev)) {
        return -EINVAL;
    }
    return rt_device_read(dev, ...);
}

The patch would require adding a validation function (e.g., rt_device_is_valid) that checks if the pointer is within a valid device object range.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running RT-Thread <= 5.1.0.
• Ability to execute system calls (e.g., via a user-space program).

Exploitation Steps:

1. Identify Target: Determine the system call number for a vulnerable function (e.g., sys_device_read).
2. Craft Payload: Set arg[0] to a kernel memory address (e.g., 0x80000000).
3. Trigger Syscall: Invoke the system call with the crafted argument.
4. Extract Data: Read the returned data, which contains kernel memory contents.

Example Exploit Code (Conceptual):

#include <rtthread.h>
#include <lwp.h>

int main(void)
{
    // Assume sys_device_read syscall number is 10
    int syscall_num = 10;
    // Target kernel address to leak
    void *kernel_addr = (void *)0x80000000;
    // Buffer to receive leaked data
    char buf[256];
    // Invoke syscall
    int ret = lwp_syscall(syscall_num, kernel_addr, buf, sizeof(buf));
    // Print leaked data
    rt_kprintf("Leaked data: %s\n", buf);
    return 0;
}

Blue Team

Detection:

• Monitor system call arguments for unusual pointer values (e.g., addresses outside user space).
• Use kernel-level auditing to log all lwp_syscall invocations.

Mitigation:

• Apply strict input validation in the kernel for all arg[0] parameters.
• Implement address space layout randomization (ASLR) to make exploitation harder.
• Restrict local access to trusted users only.

Indicators of Compromise (IOCs)

• File: rt-thread/components/lwp/lwp_syscall.c (vulnerable file)
• Syscall Pattern: Repeated calls to vulnerable syscalls with arg[0] pointing to kernel memory (e.g., 0x80000000 - 0xFFFFFFFF).
• Log Entry: Unexpected kernel memory reads in system call logs.
• Network: No network indicators (local only).

Detection Engineering

YARA Rule

rule CVE_2025_1115_RTThread_InfoDisclosure
{
    meta:
        description = "Detects exploitation attempts of CVE-2025-1115 in RT-Thread"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1115"
    strings:
        $syscall_func = "sys_device_read" nocase
        $kernel_addr = { 80 00 00 00 } // Example kernel address pattern
    condition:
        $syscall_func and $kernel_addr
}

Sigma Rule

title: CVE-2025-1115 RT-Thread Local Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2025-1115 via suspicious syscall arguments
author: Valters IT
date: 2025/04/10
logsource:
    product: rt-thread
    service: syscall
detection:
    selection:
        SyscallName:
            - "sys_device_read"
            - "sys_device_write"
            - "sys_mutex_take"
            - "sys_sem_take"
            - "sys_thread_create"
        Arg0:
            - "0x80000000"
            - "0x80001000"
            - "0x80002000"
    condition: selection
falsepositives:
    - Legitimate kernel debugging
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-1115 RT-Thread Local Information Disclosure Attempt"; content:"|80 00 00 00|"; offset:0; depth:4; classtype:attempted-information-leak; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Access: Limit user accounts and disable unnecessary services.
2. Monitor Syscalls: Implement kernel-level auditing for lwp_syscall invocations.
3. Apply ASLR: Enable kernel address space layout randomization if available.

Long-Term Fix:

• Wait for an official patch from RT-Thread. In the meantime, apply input validation patches manually to lwp_syscall.c for all affected functions.
• Consider upgrading to a patched version when available.

Workaround:

• Disable the LWP subsystem if not required, by removing lwp_syscall.c from the build configuration.

Valters IT
DevSecOps & Cyber Threat Intelligence