Talos Vulnerability Report

SUMMARY

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

STMicroelectronics X-CUBE-AZRT-H7RS 1.0.0
STMicroelectronics X-CUBE-AZRTOS-F7 1.1.0
STMicroelectronics X-CUBE-AZRTOS-F4 1.1.0
STMicroelectronics X-CUBE-AZRTOS-G0 1.1.0
STMicroelectronics X-CUBE-AZRTOS-G4 2.0.0
STMicroelectronics X-CUBE-AZRTOS-L4 2.0.0
STMicroelectronics X-CUBE-AZRTOS-L5 2.0.0
STMicroelectronics X-CUBE-AZRTOS-WB 2.0.0
STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0
STMicroelectronics X-CUBE-AZRTOS-H7 3.3.0

PRODUCT URLS

X-CUBE-AZRTOS-WL - https://www.st.com/en/embedded-software/x-cube-azrtos-wl.html X-CUBE-AZRT-H7RS - https://www.st.com/en/embedded-software/x-cube-azrt-h7rs.html X-CUBE-AZRTOS-F4 - https://www.st.com/en/embedded-software/x-cube-azrtos-f4.html X-CUBE-AZRTOS-F7 - https://www.st.com/en/embedded-software/x-cube-azrtos-f7.html X-CUBE-AZRTOS-G0 - https://www.st.com/en/embedded-software/x-cube-azrtos-g0.html X-CUBE-AZRTOS-G4 - https://www.st.com/en/embedded-software/x-cube-azrtos-g4.html X-CUBE-AZRTOS-H7 - https://www.st.com/en/embedded-software/x-cube-azrtos-h7.html X-CUBE-AZRTOS-L4 - https://www.st.com/en/embedded-software/x-cube-azrtos-l4.html X-CUBE-AZRTOS-L5 - https://www.st.com/en/embedded-software/x-cube-azrtos-l5.html X-CUBE-AZRTOS-WB - https://www.st.com/en/embedded-software/x-cube-azrtos-wb.html

CVSSv3 SCORE

4.3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

DETAILS

X-CUBE-AZRTOS-F7 (Azure RTOS STM32Cube Expansion Package) offers comprehensive integration of Microsoft Azure RTOS within the STM32Cube environment for the STM32F7 series microcontrollers. This Expansion Package encompasses a range of Azure RTOS middleware components, including the RTOS (ThreadX), USB Host and Device (USBX), file system with support for NOR and NAND flash memories (FileX and LevelX), and networking capabilities that include Ethernet and WiFi media (NetX Duo).

When processing an HTTP PUT request it is possible to cause an integer underflow condition which could result in a very large file to be written to the file system. This could cause a denial of service by consuming all of the file system resources. This vulnerability affects both HTTP server implementations within NetX Duo.

Upon receipt of an HTTP PUT request, the function _nx_web_http_server_put_process is invoked. The content length is extracted from the request at [1] and stored in the variable length. Next, the data contained in the request will be written to the requested file at [2]. Then, the number of bytes of data is calculated at [3] ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) - offset). The variable offset is the beginning of the data in the HTTP request, after the HTTP headers, and packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr is the entire size of the request. For illustration purposes, let’s say that the offset of data in the packet offset is 20, and the total packet length ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) is 80 , this means that 60 bytes of data are included in the packet ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) - offset) = 60. If the Content-Length value in the HTTP header length is 59, then this will cause an integer underflow at [3]. After the calculation at [3], length will be -1. Since the variable length is unsigned, this will be interpreted as the very large number 0xffffffff at [4]. This large number causes the code to enter and execute the loop at [4] when it otherwise shouldn’t continue processing. This loop will continue to execute and receive more data at [5] and write to the requested file at [6] until 0xffffffff bytes have been received. To summarize, an attacker could send a Content-Length value that is smaller than the data included in the request, and then continue sending data resulting in writing an excessively large file being written - potentially consuming all of the file system resources.

File: x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
4099: VOID  _nx_web_http_server_put_process(NX_WEB_HTTP_SERVER *server_ptr, NX_PACKET *packet_ptr)
4100: {
...
4103: ULONG       length = 0;
...
4140:         /* Calculate the content length from the request.  */
4141:         status =  _nx_web_http_server_content_length_get(packet_ptr, &length);    /*[1]*/
...
4363:     /* Determine if there is any content in the first packet.  */
4364:     if ((UINT)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) > offset)
4365:     {
4366: 
4367:         /* Write the content found in this packet.  */
4368:         status =  fx_file_write(&(server_ptr -> nx_web_http_server_file), (packet_ptr -> nx_packet_prepend_ptr + offset),
4369:                                 ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) - offset));    /*[2]*/
...
4391:         /* Update the length.  */
4392:         length =  length - ((ULONG)(packet_ptr -> nx_packet_append_ptr - packet_ptr -> nx_packet_prepend_ptr) - offset);  /*[3]*/
...
4447:     /* If necessary, receive more packets from the TCP socket to complete the write request.  */
4448:     while (length || server_ptr -> nx_web_http_server_request_chunked)    /*[4]*/
4449:     {
4450: 
4451:         /* Wait for a request.  */
4452:         status = _nx_web_http_server_packet_get(server_ptr, &data_packet_ptr);    /*[5]*/
...
4483:             /* Write the content of this packet.  */
4484:             status =  fx_file_write(&(server_ptr -> nx_web_http_server_file), next_packet_ptr -> nx_packet_prepend_ptr,
4485:                                                (ULONG)(next_packet_ptr -> nx_packet_append_ptr - next_packet_ptr -> nx_packet_prepend_ptr));      /*[6]*/

CVE-2024-50596 - NetX Duo Web Component HTTP Server

This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c

CVE-2024-50597 - NetX Duo Component HTTP Server

This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c

TIMELINE

2024-11-04 - Vendor Disclosure
2025-03-27 - Vendor Patch Release
2025-04-02 - Public Release