Description

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-10-12T13:17:28.150Z",
  "pubdate": "2026-10-12T13:17:28.150Z",
  "executiveSummary": "A memory corruption vulnerability exists in the legacy USB CDC virtual COM port (VCOM) driver of RT-Thread, affecting versions up to 5.3.0.\nThe vulnerability originates from an incorrect data structure aliasing within the _function_enable() function, where the rx_ringbuffer is improperly mapped as a Serial V2 rt_serial_rx_fifo.\nThis mismatch allows an attacker-controlled USB host to perform out-of-bounds writes when configuring the CDC device.\nSuccessful exploitation leads to unauthorized memory modification, including the corruption of adjacent struct vcom members and the invocation of an invalid rt_free() operation during the device closing sequence.\nThe primary impact of this vulnerability is a denial-of-service (DoS) condition, potentially resulting in system instability, kernel panics, or arbitrary memory corruption that could be leveraged for further exploitation.\nThe attack vector requires a physical connection to the device's USB interface, as the attacker must act as a malicious USB host to trigger the vulnerable configuration sequence.\nThe flaw presents a significant risk to embedded systems utilizing RT-Thread's legacy USB CDC stack, particularly those in environments where untrusted USB hosts may be connected.",
  "technicalDetails": "The vulnerability resides within the legacy USB CDC driver implementation in RT-Thread versions 5.3.0 and earlier. Specifically, the flaw is located within the _function_enable() routine, which handles the enabling of the CDC function during USB enumeration and configuration phases.\nThe root cause is a type-aliasing error where the driver incorrectly treats an instance of rx_ringbuffer as an rt_serial_rx_fifo structure. Because these structures maintain different memory layouts and internal metadata, the write operations directed at the ring buffer assume a buffer structure that does not align with the actual memory allocation.\nWhen a connected USB host initiates communication or updates settings for the CDC device, the driver executes write operations to what it perceives as the serial receive FIFO. Due to the structure mismatch, these writes overflow the intended buffer boundaries, spilling into adjacent memory fields belonging to the struct vcom object.\nThe attack flow proceeds as follows: First, an attacker connects a malicious or modified USB host to the RT-Thread device. Second, the attacker initiates a USB CDC configuration request. Third, the driver's _function_enable() function is triggered, performing the improper pointer aliasing. Fourth, the USB host transmits data or configuration commands, causing the driver to perform an out-of-bounds memory write based on the corrupted structure mapping.\nThis heap/stack-adjacent corruption leads to the degradation of the struct vcom object's internal state. When the USB connection is subsequently closed or the device is reset, the driver's cleanup routines utilize the corrupted control structures to perform memory management operations. Specifically, the logic attempts to invoke rt_free() on an incorrectly calculated address or an invalid pointer derived from the corrupted object metadata.\nThe execution of an invalid rt_free() call generally results in a heap consistency error, which in an embedded context like RT-Thread, typically triggers a hard fault or a system-wide kernel panic, thereby achieving a denial-of-service state. Furthermore, the ability to overwrite adjacent members of the struct vcom provides a potential primitives for memory corruption attacks that could, depending on the memory layout, lead to control flow hijacking if critical function pointers stored within the object are overwritten prior to the crash."
}