RT-Thread Memory Corruption Vulnerability in sys_select Function

A critical vulnerability exists in RT-Thread version 5.1.0 within the sys_select function of the lwp_syscall component. This issue arises from inadequate validation of the timeout parameter, which is only checked for NULL but not for valid memory access. Exploitation of this vulnerability could lead to memory corruption, causing kernel crashes and unauthorized access to kernel memory, with potential for privilege escalation.

Impact

Exploitation of this vulnerability can cause a kernel crash, leading to a denial-of-service condition. Additionally, it could allow a compromised user thread to access kernel memory, potentially escalating privileges.

Reproduction

The vulnerability can be reproduced by calling the sys_select function with a timeout parameter that points to invalid memory. This can be done from a user thread, taking advantage of the lack of proper validation before the timeout pointer is dereferenced.