CVE-2022-39343

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-39343

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39343.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-39343

Aliases

GHSA-8jqf-wjhq-4w9f

Published

2022-11-08T00:00:00Z

Modified

2026-07-15T02:06:14.948814115Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Azure RTOS FileX vulnerable to Buffer Offerflow

Details

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the _fx_fault_tolerant_enable function an attempt to recover the previous failed write operation is taken by call of _fx_fault_tolerant_apply_logs. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type FX_FAULT_TOLERANT_DIR_LOG_TYPE may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fxfaulttolerantapplylogs.c is documented in the GHSA.

Database specific

{
    "cwe_ids": [
        "CWE-120"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39343.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/azure-rtos/filex

Affected ranges

Type

GIT

Repo

https://github.com/azure-rtos/filex

Events

Introduced

Fixed

ef128829b4d9c142dbdf0e48e9ac67889da0ea9c

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

r6.*

r6.1.8_rel

v6.*

v6.0.1_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39343.json"