RT-Thread Null Pointer Dereference Vulnerability in sys_sendto Function

A critical null pointer dereference vulnerability has been identified in RT-Thread version 5.1.0. The issue arises in the sys_sendto system call within the Smart version of RT-Thread. The vulnerability is caused by inadequate validation of the 'to' parameter in the 'sockaddr_tolwip' function, which is invoked by 'sys_sendto'. While the code checks if the pointer is NULL, it fails to ensure that the pointer references valid memory. This flaw could be exploited by a compromised user thread, potentially leading to severe security consequences such as kernel crashes and unauthorized access to memory.

Impact

Exploitation of this vulnerability can cause a kernel crash due to invalid memory access, creating a denial-of-service condition. Additionally, in some cases, it could be used to access kernel memory, leading to privilege escalation.