Critical Flaws Found in VxWorks RTOS That Powers Over 2 Billion Devices

Security researchers have discovered almost a dozen zero-day
vulnerabilities in VxWorks, one of the most widely used real-time
operating systems (RTOS) for embedded devices that powers over 2
billion devices across aerospace, defense, industrial, medical,
automotive, consumer electronics, networking, and other critical
industries.

According to a new report Armis researchers shared with The
Hacker News prior to its release, the vulnerabilities are
collectively dubbed as URGENT/11 as they are 11 in total, 6
of which are critical in severity leading to ‘devastating’
cyberattacks.

Armis Labs is the same IoT security company that previously
discovered the BlueBorne
vulnerabilities in Bluetooth protocol that impacted more than
5.3 Billion devices—from Android, iOS, Windows and Linux to the
Internet of things (IoT).
^[1]

These vulnerabilities could allow remote attackers to bypass
traditional security solutions and take full control over affected
devices or “cause disruption on a scale similar to what resulted
from the EternalBlue
vulnerability,” without requiring any user interaction,
researchers told The Hacker News.

It’s likely possible that many of you might have never heard of
this operating system, but Wind River VxWorks is being used to run
many everyday internet-of-things such as your webcam, network
switches, routers, firewalls, VOIP phones, printers, and
video-conferencing products, as well as traffic lights.

Besides this, VxWorks is also being used by mission-critical
systems including SCADA, trains, elevators and industrial
controllers, patient monitors, MRI machines, satellite modems,
in-flight WiFi systems, and even the mars rovers.

URGENT/11 ⁠— Vulnerabilities in VxWorks RTOS

The reported URGENT/11
vulnerabilities reside in the IPnet TCP/IP networking stack of
the RTOS that was included in VxWorks since its version 6.5,
apparently leaving all versions of VxWorks released in the last 13
years vulnerable to device takeover attacks.

All 6 critical vulnerabilities let attackers trigger remote code
execution (RCE) attacks, and remaining flaws could lead to
denial-of-service, information leaks, or logical flaws.

Critical Remote Code Execution Flaws:

• Stack overflow in the parsing of IPv4 options
  (CVE-2019-12256)
• Four memory corruption vulnerabilities stemming from erroneous
  handling of TCP’s Urgent Pointer field (CVE-2019-12255,
  CVE-2019-12260, CVE-2019-12261, CVE-2019-12263)
• Heap overflow in DHCP Offer/ACK parsing in ipdhcpc
  (CVE-2019-12257)

DoS, Information Leak, and Logical Flaws:

• TCP connection DoS via malformed TCP options
  (CVE-2019-12258)
• Handling of unsolicited Reverse ARP replies (Logical Flaw)
  (CVE-2019-12262)
• Logical flaw in IPv4 assignment by the ipdhcpc DHCP client
  (CVE-2019-12264)
• DoS via NULL dereference in IGMP parsing (CVE-2019-12259)
• IGMP Information leak via IGMPv3 specific membership report
  (CVE-2019-12265)

All these flaws can be exploited by an unauthenticated, remote
attacker just by sending a specially crafted TCP packet to an
affected device without requiring any user interaction or prior
information regarding the targeted device.
However, each version of VxWorks since 6.5 is not vulnerable to all
11 flaws, but at least one critical RCE flaw affects each version
of the real-time operating system.

Armis researchers believe URGENT/11 flaws might affect devices
using other real-time operating systems as well, as IPnet was used
in other operating systems prior to its acquisition by VxWorks in
2006.

How Can Remote Attackers Exploit VxWorks Flaws?

The exploitation of VxWorks IPnet vulnerabilities also depends upon
the location of an attacker and the targeted vulnerable device;
after all, the attacker’s network packets should reach the
vulnerable system.

According to the researchers, the threat surface of URGENT/11
flaws can be divided into 3 attack scenarios, as explained below:

Scenario 1: Attacking the Network’s Defenses

Since VxWorks also powers networking and security devices such as
switches, routers, and firewalls that are usually reachable over
the public Internet, a remote attacker can launch a direct attack
against such devices, taking complete control over them, and
subsequently, over the networks behind them.
For example, there are over 775,000 SonicWall
firewalls connected to the Internet at the time of writing that
runs VxWorks RTOS, according to Shodan search engine.

Scenario 2: Attacking from Outside the Network Bypassing
Security

Besides targeting Internet-connected devices, an attacker can also
attempt to target IoT devices that are not directly connected to
the Internet but communicates with its cloud-based application
protected behind a firewall or NAT solution. According to the
researchers, a potential attacker can use DNS changing malware or
man-in-the-middle attacks to intercept a targeted device’ TCP
connection to the cloud and launch a remote code execution attack
on it.

Scenario 3: Attacking from within the Network

In this scenario, an attacker who already has positioned himself
within the network as a result of a prior attack can launch attacks
against affected VxWorks powered devices simultaneously even when
they have no direct connection to the Internet.

However, researchers also confirmed that these vulnerabilities do
not impact other variants of VxWorks designed for certification,
such as VxWorks 653 and VxWorks Cert Edition.

Armis reported these vulnerabilities to Wind River Systems
responsibly, and the company has already notified several device
manufacturers and released
patches^[5] to address the
vulnerabilities last month.

Meanwhile, affected product vendors are also in the process of
releasing patches for their customers, which researchers believe
will take time and be difficult, as is usually the case when it
comes to IoT and critical infrastructure updates. SonicWall^[6]
and Xerox^[7]
have already released patches for its firewall devices and
printers, respectively.

^[2][3][4]