Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] Heap Buffer Overflow in FinSH `msh_auto_complete_path` via Oversized Input

Abierto
  • ¿Algo no está bien?
#11,839 3 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@Acen28 ya está trabajando en esto.

Desde el 26/9/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Arch: ARM/AArch64 BSP BSP: STM32 bug Component component: finsh in progress
RT-Thread Version

v5.3.0/git-hash: cda0a63

Affected area

FinSH

Hardware/BSP vendor

STM32

Architecture

ARM / AArch64

Board and hardware details

bsp/stm32/stm32f407-atk-explorer

Develop Toolchain

GCC

Describe the bug

Description
A critical Heap Out-of-Bounds (OOB) Write vulnerability (CWE-122) exists within the RT-Thread FinSH component, specifically in the path auto-completion logic (msh_auto_complete_path or related directory parsing functions).

When a user interacts with the msh shell (e.g., via a serial terminal or a remote network console) and attempts to trigger path auto-completion (typically using the <Tab> key) on an excessively long or deeply nested directory string, the underlying string manipulation routine fails to enforce strict boundary checks.

The function allocates a fixed-size buffer on the heap (often bounded by macros like RT_PATH_MAX or a hardcoded 256 bytes, e.g., full_path). During the concatenation of the current working directory and the user-supplied input, a while loop or strcpy/memcpy equivalent copies the oversized input string past the allocated bounds of the heap buffer.

This silent memory corruption overwrites adjacent heap metadata. The system does not crash immediately upon the OOB write. However, during the next memory allocation or deallocation cycle, the corrupted heap metadata is dereferenced, leading to an immediate HardFault or offering an attacker the potential for Heap-based Arbitrary Code Execution.

Prerequisites to Reproduce

  1. The FinSH/msh component is enabled and accessible to the user/attacker.
  2. The RT_USING_DFS (Device Virtual File System) and RT_USING_DFS_DEVFS are enabled, allowing directory traversal and path completion.

Steps to Reproduce

  1. Boot the RT-Thread system and connect to the FinSH interactive shell (via UART or Telnet).
  2. Input an excessively long string intended as a directory path. For example, input cd / followed by a payload of over 256 'A' characters:
    msh > cd /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
  3. Trigger the auto-complete function (usually by sending the \t (Tab) character via the input stream).
  4. The msh_auto_complete_path function attempts to parse and concatenate the path. The oversized string silently overflows the full_path heap buffer.
  5. Execute any subsequent command that requires dynamic memory allocation (e.g., ls or running a network task).
  6. The system throws a HardFault (or MemManage fault) due to corrupted heap metadata during rt_malloc or rt_free.
Other additional context

No response

Lenguaje dominante
C
Estrellas
12.3k
Forks
5.5k
Merge medio
4 d 12 h
PR fusionados (30 d)
32

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de RT-Thread/rt-thread

Todos los issues de RT-Thread/rt-thread

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.