Apache NuttX RTOS Invalid Pointer Vulnerability in File System Inode Management

A vulnerability allowing the release of an invalid pointer or reference has been identified in the Apache NuttX RTOS, specifically in the inode management code responsible for removing inodes from the root filesystem. This vulnerability, present in versions 10.0.0 prior to 12.10.0, can lead to the removal of inodes, triggering a debug assertion (which is disabled by default), causing a NULL pointer dereference (with effects varying by architecture), or generally resulting in a denial-of-service condition. The issue primarily affects users of filesystem-based services with write access that are exposed over the network, such as FTP.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, triggered by a NULL pointer dereference or a debug assertion failure.

Remediation

Users are advised to upgrade to Apache NuttX RTOS version 12.10.0, which addresses this vulnerability.