CVE-2025-5865

Executive Summary

CVE-2025-5865 is a critical memory corruption vulnerability discovered in RT-Thread version 5.1.0, specifically within the sys_select function in the file rt-thread/components/lwp/lwp_syscall.c. The vulnerability arises from improper validation of the timeout parameter passed to the system call handler. An attacker can manipulate this argument to cause memory corruption, potentially leading to arbitrary code execution, denial of service, or privilege escalation within the RT-Thread kernel.

The vendor has acknowledged the issue, stating that the timeout parameter should be checked to ensure it can be accessed correctly in kernel mode and used temporarily in kernel memory. However, no official patch has been released at this time. The vulnerability is classified as critical due to its potential impact on system integrity and availability.

Supply Chain & Package Security

RT-Thread is an open-source real-time operating system (RTOS) widely used in embedded systems, IoT devices, and industrial control systems. The vulnerability is present in the core kernel component (lwp_syscall.c), which is part of the main RT-Thread repository. As such, any system or product built on RT-Thread 5.1.0 is potentially affected. There are no known package-specific mitigations or patches available from the official RT-Thread distribution channels.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, the vulnerability is rated as critical based on the following assessment:

• Attack Vector (AV): Local (L) – The attacker requires local access to the system to invoke the vulnerable system call.
• Attack Complexity (AC): Low (L) – The manipulation of the timeout argument is straightforward.
• Privileges Required (PR): Low (L) – The attacker needs user-level privileges to call sys_select.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability affects the kernel's memory space.
• Confidentiality (C): High (H) – Memory corruption can lead to information disclosure.
• Integrity (I): High (H) – Memory corruption can allow modification of kernel data.
• Availability (A): High (H) – Memory corruption can cause system crashes or denial of service.

Estimated CVSS Score: 7.8 (High) to 9.0 (Critical) depending on the exact impact.

Deep Dive & Mechanics

The vulnerability resides in the sys_select function within lwp_syscall.c. This function is part of the Light-Weight Process (LWP) subsystem, which provides system call interfaces for user-space processes. The sys_select function is used to monitor multiple file descriptors for readiness (similar to the POSIX select() system call).

The vulnerable code path involves the timeout parameter, which is a pointer to a struct timeval in user space. The function fails to properly validate this pointer before dereferencing it in kernel mode. Specifically, the kernel does not check whether the timeout pointer points to valid, accessible memory in the user-space context. An attacker can provide a crafted timeout pointer that points to kernel memory or an invalid address, leading to:

• Memory Corruption: The kernel may write to an arbitrary memory location when copying or using the timeout value.
• Kernel Panic: Accessing invalid memory can cause a system crash.
• Privilege Escalation: By carefully crafting the timeout pointer, an attacker may overwrite kernel structures to gain elevated privileges.

The vendor's comment indicates that the fix should involve checking the timeout parameter to ensure it can be accessed correctly in kernel mode and using a temporary kernel memory buffer for the operation.

Vulnerable vs. Patched Code

Vulnerable Code (RT-Thread 5.1.0):

// File: rt-thread/components/lwp/lwp_syscall.c
static int sys_select(int nfds, fd_set *readfds, fd_set *writefds,
                      fd_set *exceptfds, struct timeval *timeout)
{
    // ... other code ...
    if (timeout != RT_NULL)
    {
        // Directly dereferences user-space pointer without validation
        rt_tick_t ticks = timeout->tv_sec * RT_TICK_PER_SECOND +
                          timeout->tv_usec / (1000000 / RT_TICK_PER_SECOND);
        // ... use ticks ...
    }
    // ... rest of function ...
}

Patched Code (Hypothetical Fix):

// File: rt-thread/components/lwp/lwp_syscall.c
static int sys_select(int nfds, fd_set *readfds, fd_set *writefds,
                      fd_set *exceptfds, struct timeval *timeout)
{
    struct timeval kernel_timeout;
    // ... other code ...
    if (timeout != RT_NULL)
    {
        // Validate and copy user-space data to kernel memory
        if (rt_lwp_copy_from_user(&kernel_timeout, timeout, sizeof(struct timeval)) != 0)
        {
            return -EFAULT;
        }
        rt_tick_t ticks = kernel_timeout.tv_sec * RT_TICK_PER_SECOND +
                          kernel_timeout.tv_usec / (1000000 / RT_TICK_PER_SECOND);
        // ... use ticks ...
    }
    // ... rest of function ...
}

The patched code uses a safe copy function (rt_lwp_copy_from_user) to copy the timeout structure from user space to kernel memory, ensuring that the pointer is valid and preventing memory corruption.

Exploitation & Lab Setup

Red Team

Objective: Exploit the memory corruption to achieve privilege escalation or denial of service.

Prerequisites:

• Local access to an RT-Thread 5.1.0 system with user-level privileges.
• Ability to compile and run a C program on the target.

Exploit Concept:

1. Craft a malicious timeout pointer that points to a kernel memory location (e.g., a function pointer table).
2. Call sys_select with the crafted pointer.
3. The kernel will dereference the pointer and write the computed ticks value to that location, corrupting kernel data.

Example Exploit Code (Conceptual):

#include <sys/select.h>
#include <stdio.h>
#include <stdlib.h>

int main() {
    fd_set readfds;
    struct timeval *evil_timeout;

    // Allocate a pointer to kernel memory (requires knowledge of kernel layout)
    // This is a simplified example; actual exploitation requires precise memory mapping
    evil_timeout = (struct timeval *)0xFFFFFFFF; // Example invalid address

    FD_ZERO(&readfds);
    FD_SET(0, &readfds); // Monitor stdin

    // Trigger the vulnerability
    int ret = select(1, &readfds, NULL, NULL, evil_timeout);
    if (ret == -1) {
        perror("select");
    }

    return 0;
}

Note: Actual exploitation requires detailed knowledge of the target's memory layout and may involve heap spraying or other techniques.

Blue Team

Objective: Detect and prevent exploitation attempts.

Detection:

• Monitor system logs for kernel panics or crashes related to sys_select.
• Use kernel-level auditing to detect invalid memory access attempts.
• Implement runtime checks for user-space pointer validation.

Prevention:

• Apply the vendor's patch as soon as it becomes available.
• Use kernel hardening techniques such as SMEP/SMAP (Supervisor Mode Execution Prevention / Supervisor Mode Access Prevention) if supported by the hardware.
• Restrict local access to trusted users only.

Indicators of Compromise (IOCs)

• System Logs: Kernel panic messages referencing sys_select or lwp_syscall.c.
• Memory Dumps: Corrupted kernel memory regions, especially near function pointer tables.
• Process Behavior: Unusual system calls with invalid timeout pointers.
• File Hashes: Modified kernel binaries or libraries (if patched without official update).

Detection Engineering

YARA Rule

rule CVE_2025_5865_RT_Thread_Memory_Corruption {
    meta:
        description = "Detects exploitation attempts of CVE-2025-5865 in RT-Thread"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5865"
    strings:
        $s1 = "sys_select" ascii wide nocase
        $s2 = "lwp_syscall.c" ascii wide nocase
        $s3 = "timeout" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-5865 RT-Thread sys_select Memory Corruption
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-5865 via sys_select system call with invalid timeout pointer
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "kernel: BUG: unable to handle kernel paging request"
        - "kernel: RIP: sys_select"
        - "kernel: Call Trace:"
        - "lwp_syscall.c"
    condition: selection
falsepositives:
    - Rare kernel bugs unrelated to this CVE
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-5865 RT-Thread sys_select Memory Corruption Attempt"; content:"|73 79 73 5f 73 65 6c 65 63 74|"; distance:0; within:10; content:"|74 69 6d 65 6f 75 74|"; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Restrict local access to the RT-Thread system to trusted users only.
2. Patch Application: Monitor the official RT-Thread repository for a patch. Apply it as soon as it is released.
3. Workaround: If patching is not possible, consider disabling the sys_select system call or implementing a kernel module that validates the timeout pointer before the vulnerable function is called.
4. Long-term: Implement kernel hardening measures such as SMEP/SMAP and regular security audits of system call handlers.

Valters IT
Securing Digital Frontiers