GHSA-p7w6-62rq-vrf9: Azure RTOS ThreadX Remote Code Execution Vulnerability

GHSA ID	GHSA‑p7w6‑62rq‑vrf9
CVE ID	CVE‑2023‑48693
Severity	High
CVSS score	8.7 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L`)
Published	2023‑12‑03
Last updated	2023‑12‑03

GHSA ID

GHSA‑p7w6‑62rq‑vrf9

CVE ID

CVE‑2023‑48693

Severity

High

CVSS score

8.7 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L)

Published

2023‑12‑03

Last updated

2023‑12‑03

Affected packages

Package	Vulnerable versions	Patched versions
ThreadX	<6.3.0	6.3.0

Package

Vulnerable versions

Patched versions

ThreadX

<6.3.0

6.3.0

Description

Impact An attacker can cause arbitrary read and write due to vulnerability in parameter checking mechanism in Azure RTOS ThreadX, which may lead to privilege escalation.

Affected Components The affected components include RTOS ThreadX v6.2.1 and below. The fixes have been included in ThreadX release 6.3.0.

Remediation Upgrade to v6.3.0 or above.

For more information If you have any questions or comments about this advisory: • Open an issue in azure-rtos/threadx • Post question on Microsoft Q&A