CVE-2024-50594,CVE-2024-50595
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
STMicroelectronics X-CUBE-AZRT-H7RS 1.0.0
STMicroelectronics X-CUBE-AZRTOS-F7 1.1.0
STMicroelectronics X-CUBE-AZRTOS-F4 1.1.0
STMicroelectronics X-CUBE-AZRTOS-G0 1.1.0
STMicroelectronics X-CUBE-AZRTOS-G4 2.0.0
STMicroelectronics X-CUBE-AZRTOS-L4 2.0.0
STMicroelectronics X-CUBE-AZRTOS-L5 2.0.0
STMicroelectronics X-CUBE-AZRTOS-WB 2.0.0
STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0
STMicroelectronics X-CUBE-AZRTOS-H7 3.3.0
X-CUBE-AZRTOS-WL - https://www.st.com/en/embedded-software/x-cube-azrtos-wl.html X-CUBE-AZRT-H7RS - https://www.st.com/en/embedded-software/x-cube-azrt-h7rs.html X-CUBE-AZRTOS-F4 - https://www.st.com/en/embedded-software/x-cube-azrtos-f4.html X-CUBE-AZRTOS-F7 - https://www.st.com/en/embedded-software/x-cube-azrtos-f7.html X-CUBE-AZRTOS-G0 - https://www.st.com/en/embedded-software/x-cube-azrtos-g0.html X-CUBE-AZRTOS-G4 - https://www.st.com/en/embedded-software/x-cube-azrtos-g4.html X-CUBE-AZRTOS-H7 - https://www.st.com/en/embedded-software/x-cube-azrtos-h7.html X-CUBE-AZRTOS-L4 - https://www.st.com/en/embedded-software/x-cube-azrtos-l4.html X-CUBE-AZRTOS-L5 - https://www.st.com/en/embedded-software/x-cube-azrtos-l5.html X-CUBE-AZRTOS-WB - https://www.st.com/en/embedded-software/x-cube-azrtos-wb.html
4.3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-191 - Integer Underflow (Wrap or Wraparound)
X-CUBE-AZRTOS-F7 (Azure RTOS STM32Cube Expansion Package) offers comprehensive integration of Microsoft Azure RTOS within the STM32Cube environment for the STM32F7 series microcontrollers. This Expansion Package encompasses a range of Azure RTOS middleware components, including the RTOS (ThreadX), USB Host and Device (USBX), file system with support for NOR and NAND flash memories (FileX and LevelX), and networking capabilities that include Ethernet and WiFi media (NetX Duo).
When processing an HTTP PUT request it is possible to cause an integer underflow condition which could result in a very large file to be written to the file system. This could cause a denial of service by consuming all of the file system resources. This vulnerability affects both HTTP server implementations within NetX Duo.
Upon receipt of an HTTP PUT request, the function _nx_web_http_server_put_process is invoked. The content length is extracted from the request at [1] and stored in the variable length. Because the value of length is > 0 execution will eventually enter the loop at [2]. For illustration purposes, let’s say that in the HTTP request (the first packet sent) the Content-Length in the HTTP header is 32, but no data is included in this packet. A second packet will be received at [3]. Let’s also say that the second packet which contains only data has a length of 33 bytes. At [5] and integer underflow will occur. Since the Content-Length value is stored in the length variable and is 32 in our example, the length of the second packet is calculated at [5] with (UINT)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr) and is 33 in our example. After the calculation at [5] is completed, length will be -1. Since the variable length is unsigned, this will be interpreted as the very large number 0xffffffff at [2]. This large number has causes the code to continue executing the loop at [2] when it otherwise shouldn’t continue processing. This loop will continue to execute until 0xffffffff bytes are received and also written to the requested file at [4]. To summarize, an attacker could send a Content-Length value in the first packet that is smaller than the length of the data sent in the second packet, and continue sending more data resulting in writing an excessively large file being written. This could potentially consume all of the file system resources.
File: x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
4099: VOID _nx_web_http_server_put_process(NX_WEB_HTTP_SERVER *server_ptr, NX_PACKET *packet_ptr)
4100: {
...
4103: ULONG length = 0;
...
4140: /* Calculate the content length from the request. */
4141: status = _nx_web_http_server_content_length_get(packet_ptr, &length); /*[1]*/
...
4447: /* If necessary, receive more packets from the TCP socket to complete the write request. */
4448: while (length || server_ptr -> nx_web_http_server_request_chunked) /*[2]*/
4449: {
4450:
4451: /* Wait for a request. */
4452: status = _nx_web_http_server_packet_get(server_ptr, &data_packet_ptr); /*[3]*/
...
4483: /* Write the content of this packet. */
4484: status = fx_file_write(&(server_ptr -> nx_web_http_server_file), next_packet_ptr -> nx_packet_prepend_ptr,
4485: (ULONG)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr)); /*[4]*/
...
4504: /* Update the length. */
4505: length = length - (UINT)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr); /*[5]*/
This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
Developers can disable the processing of PUT requests by ending the processing of a PUT request in an application callback request notify function.
This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
Developers can disable the processing of PUT requests by ending the processing of a PUT request in an application callback request notify function.
2024-11-04 - Vendor Disclosure
2025-03-27 - Vendor Patch Release
2025-04-02 - Public Release
Discovered by Kelly Patterson of Cisco Talos.