CVE-2021-42303: Azure RTOS Elevation of Privilege Vulnerability

Overview

Severity
Medium (CVSS 6.6)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2021-Nov
Released
2021-11-09
EPSS Score
0.39% (percentile: 59.9%)

FAQ

What is RTOS? Azure RTOS is an embedded development suite including a small but powerful operating system that provides reliable, ultra-fast performance for resource-constrained devices. See Azure RTOS Overview for more information. What version of Azure RTOS has the update that protects from this vulnerability? Version 6.1.9 According to the CVSS, User Interaction is Required. What interaction would the user have to do? Exploitation of this vulnerability requires that a user plug in a malicious USB device. What is the action required to take the update? You need to recompile your project with updated USBX source code if the project uses host audio/video/CDC-ECM/PIMA, or device storage class.

Affected Products (1)

Azure

  • Azure Real Time Operating System

Acknowledgments

Szymon Heidrich

Revision History

  • 2021-11-09: Information published.