PT-2023-30902 · Microsoft · Azure Rtos Threadx

Publicado 2023-12-04 · Atualizado 2023-12-08 · CVE-2023-48693

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Azure RTOS ThreadX versions prior to 6.3.0

Description Azure RTOS ThreadX is an advanced real-time operating system (RTOS) designed specifically for deeply embedded applications. An attacker can cause arbitrary read and write due to a vulnerability in the parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation.

Recommendations For Azure RTOS ThreadX versions prior to 6.3.0, upgrade to ThreadX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable parameter checking mechanism until a patch is available. Avoid using the vulnerable components in Azure RTOS ThreadX until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-48693

GHSA-P7W6-62RQ-VRF9

Produtos afetados

Azure Rtos Threadx

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48693.json · Exploit
• https://github.com/azure-rtos/threadx/security/advisories/GHSA-p7w6-62rq-vrf9 · Nota
• https://t.me/cvenotify/62231 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48693 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48693 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1731842503773761861 · Publicação no Twitter